On October 22, 2026, Arista disclosed that its on-premises VeloCloud Orchestrator (VCO) carries an actively exploited SQL injection: any authenticated user, down to the Enterprise Read Only role, can become the superuser operator. If you self-host a VCO, upgrade immediately and assume every account — read-only included — has already been abused.
On October 16, 2026, BeyondTrust fixed CVE-2026-102764, an authentication bypass in Remote Support that the China-linked actor Armory Castle has exploited as a zero-day since late August. If you self-host RS or PRA and the appliance was reachable from the internet, treat it as compromised, not merely as something to patch.
On 15 October 2026, Check Point confirms that CVE-2026-85102, a pre-authentication remote code execution flaw in its Security Gateway VPN fixed on 9 September, is now being exploited at scale against Spark firewalls, and ships a fix for a zero-day in its management server. Apply both hotfixes, starting with your management servers, which are watched less closely than the gateways.
On October 13, 2026, Ivanti patched CVE-2026-104935, an authentication bypass exploited as a zero-day on its Connect Secure VPN gateways, which Volexity ties to a three-flaw chain ending in root. The compromise leaves nothing the vendor’s integrity tool can see: patch on an emergency basis and verify every appliance forensically.
On October 13, 2026, Microsoft’s Patch Tuesday landed a record 1,411 fixes, including an already-exploited Windows Shell zero-day and a cluster of CVSS 9.8 remote-code-execution flaws on network-facing Windows services. Here is the patch order that actually protects an estate, from the exposed surface inward.
Pwn2Own Ireland 2026 wrapped on 9 October 2026 with 98 zero-day flaws demonstrated and $1,262,000 in prizes, led by Ikotas Labs. The leaderboard confirms the hunting ground is shifting toward mobile and AI infrastructure.
A chain of two Zammad flaws — session hijacking followed by privilege escalation to root — was exploited against the Dutch Institute for Vulnerability Disclosure on 21 September 2026 and added to CISA’s KEV catalog on 2 October. Move your Zammad instances to version 7 and treat any exposed instance as potentially compromised, because patching alone does not remove an attacker’s persistence.
After the emergency fix for CVE-2026-88771 and CVE-2026-88772, NetScaler ADC and Gateway administrators report reboot loops caused by forged SAML traffic that crashes the nsaaad authentication service. Preserve logs before every restart and follow Citrix guidance — this is a separate issue, with no CVE published yet.
CVE-2026-104286, rated CVSS 9.8, lets an unauthenticated attacker write arbitrary files on FortiMail's management interface through a path traversal combined with a NULL byte. No fix is out yet — disable IBE and take the admin console off the internet.
CVE-2026-76504 lets an unauthenticated attacker bypass Catalyst SD-WAN Manager authentication through URI encoding and gain admin rights. There is no workaround: patch immediately and inspect j_security_check logs.
Mandiant and Google Threat Intelligence attribute CVE-2026-88772 to a state-sponsored actor that has exploited the NetScaler DTLS flaw since early September across dozens of organizations. Updating is not enough: hunt for web shells and rotate stolen credentials.
An out-of-bounds write in CoreGraphics allows code execution when a crafted file is opened, and CISA added it to the KEV catalog after confirmed exploitation. Roll out iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1 immediately, starting with the devices of exposed people.
watchTowr has documented two remote-code-execution zero-days in Citrix NetScaler ADC and Gateway, already exploited before any fix existed. With nothing published by Citrix, the only defense is isolation: preserve evidence, cut the appliance off the network and keep management off the internet.
On September 25, 2026, Kiteworks CISO Frank Balonis asked every customer to power down their servers for six hours on Saturday after federal intelligence authorities warned of an imminent attack. If you run a managed file transfer appliance, read this as a signal: MFT appliances remain the top target of extortion gangs.
On September 22, 2026, Check Point published an “Action Required” advisory confirming in-the-wild exploitation of two CVSS 9.8 vulnerabilities: CVE-2026-85102 in the Security Gateway VPN and the zero-day CVE-2026-93616 in the Management server. Apply the fixes immediately and hunt for anomalous Mobile Access logins.
On September 22, 2026, F5 disclosed CVE-2026-94127, a CVSS 9.8 flaw in the BIG-IP APM module being actively exploited against systems running as OAuth authorization servers. Apply the engineering hotfix or the iRule workaround, then hunt for repeated OAuth authentication failures.
On September 22, 2026, D-Link confirmed two critical flaws in the end-of-life DIR-822A router: a stack-based buffer overflow in the DHCP server (CVE-2026-86296, CVSS 10) and an out-of-bounds write in the L2TP parser (CVE-2026-86510, CVSS 9.9), both with public proof-of-concept code and no patch available. Replace or isolate these routers, and never expose them to the internet.
On September 22, 2026, researcher Patrick Wardle showed that an undocumented setting in Muse, Meta’s AI assistant, lets a simple local command redirect voice dictation and steal the account authentication token. Cut back the permissions you grant AI agents and wait for Meta’s fix before deploying new ones.
On September 16, 2026 Google confirmed exploitation of CVE-2026-58704, a privilege escalation in the Pixel cellular modem, in limited targeted attacks. Apply the September 2026 patch and make the Android patch level a compliance gate for your mobile fleet.
Microsoft delivered 973 fixes on September 8, 2026 — the biggest Patch Tuesday in its history — including two elevation-of-privilege flaws already exploited in the wild. Deploy the two zero-days within 24 hours, then address the critical remote-code-execution flaws within seven days.
CVE-2026-76461 (CVSS 9.8), a zero-day in the AsyncOS email parsing of Cisco Secure Email Gateway, has been exploited since September 2026 to turn a SQL injection into root command execution. Cisco offers no workaround and CISA requires a fix by September 17, 2026: patch your Secure Email Gateway appliances now.
On September 8, 2026, Google ships Chrome 153, fixing 230 vulnerabilities including CVE-2026-87491, an out-of-bounds write in V8 already exploited in the wild. Update to 153.0.8010.36 or later before the CISA deadline of September 23, and check every Chromium browser in your fleet, Edge, Brave and Opera included.
The September 8, 2026 Patch Tuesday breaks a record with 964 CVEs, including two zero-days already exploited in the wild, CVE-2026-81963 and CVE-2026-85880. Triage the bulletin by exploitability — zero-days first, then internet-facing RCEs — rather than by raw score.
A researcher releases FalconFlank, a zero-day that abuses CrowdStrike Falcon’s Office macro remediation to gain SYSTEM privileges on fully patched Windows 11 and Server machines. Disable the suspicious macro removal policy until an official fix lands.
Sansec documents StyleSmuggler, a Magento and Adobe Commerce zero-day exploited since September 4, 2026 that runs code without authentication through the template engine and installs a persistent backdoor. Adobe has published no CVE and no patch yet: disable GraphQL on your stores while waiting for the September 8 bulletin.
On September 4, 2026, Google shipped an emergency Chrome update fixing CVE-2026-85046, a type confusion in the V8 engine already exploited in the wild and rated 8.8 on the CVSS scale. Update to Chrome 152.0.7977.82 or later and check every Chromium browser in your fleet, including Edge, Brave and Opera.
On September 1, 2026, SonicWall disclosed two flaws in the SMA 1000 line — a pre-authentication SSRF (CVE-2026-83548, CVSS 10) and an OS command injection (CVE-2026-83549) — already chained in the wild to reach remote code execution without credentials. Apply the hotfix now, and if compromise is confirmed, re-image the appliance instead of patching over the intrusion.
On August 27, 2026, PaperCut confirmed active exploitation of two zero-days in its NG and MF print management products, chained into unauthenticated code execution. The first emergency patch was already bypassed: apply the second version and cut internet access.
Two flaws in SonicWall SMA 1000 VPN gateways — a CVSS 10 SSRF and a code injection — were exploited as zero-days by INC Ransomware from July 2026. Applying the patch is necessary but not sufficient: attackers roll vulnerable firmware back to keep their foothold.
Disclosed on August 12, 2026, an unauthenticated SQL injection in GeoServer’s jsonArrayContains function can lead to remote code execution, and no patch is available yet. Attackers are already probing exposed instances: isolate yours before the fix lands.
On August 11, 2026 researcher Nightmare Eclipse published ShieldBreak, a proof of concept that bypasses the fix for CVE-2026-50656 (RoguePlanet), the Microsoft Defender flaw patched in July. Independent analysts have confirmed it works, and Microsoft has not yet shipped a new fix.
The August 11, 2026 Patch Tuesday ships 421 fixes — a zero-day already exploited in the wild (CVE-2026-68820) by North Korea’s Lazarus group, plus two network flaws exploitable without authentication. Here is the patch order that actually protects your estate.
On August 8, 2026, Metabase disclosed a maximum-severity SQL injection flaw (CVSS 10.0) that was already being exploited in the wild. The vulnerability lets unauthenticated attackers gain administrator privileges and drain every connected database. Self-hosted Metabase admins must patch, revoke sessions, and rotate all secrets immediately.
On July 29, 2026, Cisco disclosed two zero-day vulnerabilities in Secure Firewall Management Center: static hardcoded credentials (CVE-2026-20316) and a CVSS 10.0 authentication bypass (CVE-2026-20079). Check your logs immediately — both flaws share the same indicator of compromise.
CVE-2026-16723 (CVSS 9.0) enables unauthenticated RCE on Fastjson 1.x with no patch forthcoming — ever. Enable SafeMode immediately and plan your Fastjson 2.x migration. Here is the three-step response plan.
The first half of 2026 saw AI become an offensive weapon, zero-days consolidate into campaigns, and license wars fracture the open source stack. Here’s what every CISO and infrastructure lead needs to act on before the year ends.
On March 31, 2026, Google shipped an emergency patch for CVE-2026-5281, an already-exploited use-after-free in Dawn, Chromium’s WebGPU implementation. It’s Chrome’s fourth zero-day in four months — and a clear signal that low-level graphics APIs have become the browser exploitation frontier.
The group systematically exploited CVE-2024-50623 and CVE-2024-55956 in Cleo MFT products between October and December 2024, affecting over 180 organizations. The October patch failed; a second CVE had to be issued six weeks later.
Microsoft shipped an emergency out-of-band patch for CVE-2026-21509 on January 26, 2026. APT28 exploited it the next day against government institutions and financial-sector targets. The patch-to-exploit window just collapsed.
