SAP addressed 20 vulnerabilities across multiple products in its September 2026 security updates, BleepingComputer reported on 8 September 2026. SAP's CVE record for CVE-2026-44756 (published 8 September 2026, 8:10 am Perth) describes a memory safety vulnerability in the Extended Passport Protocol (EPP) processing library: under specific conditions an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behaviour and abnormal program termination, with a possible high impact on confidentiality, integrity and availability; SAP scores it CVSS 3.1 10.0 and points to SAP Note 3747649. BleepingComputer reports that the flaw, dubbed OVERPASS by Onapsis researchers who reported it, is a buffer overflow that lets unprivileged attackers run arbitrary commands on vulnerable SAP hosts with administrative privileges and can be exploited over SAP Internet Communication Manager (ICM). Onapsis CTO JP Perez-Etchegoyen said a targeted search identifies more than 10,000 unique internet-facing IP addresses presenting an SAP web interface, a figure he called conservative. On the same patch day SAP fixed CVE-2026-58240 (S4GET), a critical missing-authentication flaw in the SAP NetWeaver Message Server; Onapsis researcher Pablo Artuso said it is triggered through the same public port every SAP GUI client connects to, so it cannot be firewalled away without breaking user logon, needs no credentials, certificate or misconfiguration, and yields remote code execution as <sid>adm on every application server in the cluster. (sources: SAP CVE record via cve.org; BleepingComputer) Correction (1 Nov 2026): removed the SecurityWeek link and credit, which this desk cannot read; details that came only from SecurityWeek (the list of SAP products on the vulnerable kernel, database-credential and session impacts, the attack paths via SAP GUI and RFC, CVE-2026-76969 and CVE-2026-66768, and the exploitation note) have been removed. The CVSS score now comes from SAP's CVE record, and the card date stays 8 September 2026, the record's publication date.
BleepingComputer — SAP warns of maximum-severity OVERPASS kernel vulnerability (8 Sep 2026)
Microsoft’s 8 September 2026 Patch Tuesday is its largest security release on record. BleepingComputer counts 966 flaws shipped on Patch Tuesday itself (105 Critical, including 81 RCE), excluding 204 flaws fixed earlier in the month in cloud products. Two actively exploited elevation-of-privilege zero-days are fixed: CVE-2026-81963 (Windows Update Stack link-following to SYSTEM; credited to Romain Deperne and MSTIC) and CVE-2026-85880 (Windows ALPC heap buffer overflow to SYSTEM / AppContainer sandbox escape; Volexity and Proofpoint researchers). Coverage notes ~20 potentially wormable unauthenticated RCEs in the set and calls out Exchange (CVE-2026-55007), SharePoint (CVE-2026-69465), RDS (CVE-2026-69525), SQL (CVE-2026-65669), and Authenticator (CVE-2026-80097) among high-priority items. Microsoft attributes the volume increase partly to AI-assisted vulnerability discovery. NEW 8 Sep KEV: CISA added both exploited zero-days to the Known Exploited Vulnerabilities catalog on 2026-09-08 (catalog 2026.09.08) — CVE-2026-81963 and CVE-2026-85880 (FCEB dueDate 2026-09-22). WA SOC advisory 20260909001 (9 September 2026, TLP:CLEAR) summarises the September Monthly Updates as addressing 973 vulnerabilities, highlights critical CVE-2026-69730 and CVE-2026-69525 (CVSS 9.8) plus the two known-exploited EoPs (CVSS 7.8), notes Microsoft detected exploitation of one or more of the mentioned vulnerabilities, and says WASOC has not received WA Government exploitation reports at the time of writing. Prioritise the two exploited EoPs, internet-facing roles, and Extended Security Updates where applicable. UPDATE (23 Oct 2026; Enclave, Microsoft): Enclave researcher Ofek Levin published details on 23 October of 'AuthMask', a Microsoft Authenticator for Android flaw tracked as CVE-2026-80097, which Microsoft's advisory lists as released on 8 September. Enclave says Microsoft confirmed and fixed the issue after Enclave reported it. Enclave also says an Android app with zero permissions could pretend to be any installed Microsoft first-party app, such as Teams, and get Authenticator, acting as the sign-in broker, to hand it that app's tokens for a work account signed into Authenticator, because an exported activity trusted the caller's own description of itself; in Enclave's tests the tokens gave full delegated mailbox, files and calendar access and, by impersonating Authenticator's own client, the ability to create and delete passkeys, with no user interaction beyond having Authenticator signed in to a work account. Microsoft's advisory (released 8 September) rates it CVSS 3.1 8.6, Important, says an attacker would need to install a malicious app on the device and convince the user to complete an authentication flow in Authenticator, and lists it as not exploited and not publicly disclosed at the time of original publication; the CVE record lists Microsoft Authenticator for Android from 6.0.0 to before 6.2606.4246 as affected. Help Net Security reported the research on 27 October. (source: Enclave; Microsoft Security Update Guide CVE-2026-80097; Help Net Security) Correction (29 Oct 2026): removed a CVE count credited to SecurityWeek and Krebs, which are not linked sources. (source: Microsoft)
BleepingComputer — September 2026 Patch Tuesday (8 Sep 2026)
Red Hat's CVE-2026-76578 page rates the flaw Critical: a remote, unauthenticated LDAP client can abuse FreeIPA's self-managed-token ACI, together with a separately tracked flaw in 389 Directory Server's ACI evaluation, to create an attacker-chosen Kerberos principal and have it added to the administrators group, giving genuine FreeIPA administrator-group membership and administrative operations against the directory. The FreeIPA 4.13.4 release notes list CVE-2026-76578 among the security issues fixed. Until a fixed package is available, Red Hat advises restricting the LDAP service (typically ports 389/636) to trusted hosts; disabling anonymous LDAP binds blocks this specific attack path. (sources: Red Hat; FreeIPA) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Red Hat; FreeIPA)
Progress Telerik critical security bulletin (updated 22 July 2026) covers a chain in UI for ASP.NET AJAX RadAsyncUpload / RadPersistenceManager / RadDockLayout (CVE-2026-13181 through CVE-2026-13186 and CVE-2026-13190). Unauthenticated remote code execution is possible when preconditions are met (reachable RadAsyncUpload with FileUploaded handler reading UploadResult; explicit non-default Telerik.AsyncUpload.ConfigurationEncryptionKey). CVE-2026-13181 is CVSS 3.1 8.1 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fixed in 2026.2.708 (2026 Q2 SP1); affected RadAsyncUpload builds from 2010.1.309 through 2026.2.519. NEW material this window: TantoSec (7 September 2026) published a full write-up and public exploit tooling (telerik-rau-exploit) turning the AES-CBC padding oracle into webshell/in-memory payloads. Progress/Telerik state no confirmed in-the-wild exploitation in the bulletin era; treat the newly public exploit tooling as elevating patch priority. (sources: Telerik KB bulletin; TantoSec)
N-able N-central 2026.3 Hotfix 4 (build 2026.3.1.14, status post 6 September 2026, notes last updated 5 September) fixes CVE-2026-86218, a critical pre-authenticated remote code execution flaw (static code injection) on the N-central server. WA SOC advisory 20260907002 (7 September 2026, TLP:CLEAR) rates it CVSS 10 Critical for N-central prior to 2026.3.1.14 and points to N-able security advisory aArVy0000002Ld3KAE. Hosted NCOD instances are already patched; on-premises customers must upgrade to HF4 immediately (HF3 / 2026.3.1.13 remains vulnerable to this CVE). The preceding Hotfix 3 (5 September) fixed high-severity authentication-bypass CVE-2026-86206 and CVE-2026-86207. NEW 8–9 Sep: CISA added CVE-2026-86218 to the KEV catalog on 2026-09-08 as static code injection / pre-auth RCE; FCEB dueDate 2026-09-11; forensicTriage Yes; KEV notes link the N-able status post and advisory aArVy0000002Ld3KAE. (sources: N-able status HF4; WA SOC 20260907002; CISA KEV) Correction (27 Oct 2026): removed a line saying Shadowserver had tracked roughly 1,500 internet-exposed N-central servers; none of the card's sources states it. Correction (31 Oct 2026): the card date has moved from 5 to 6 September 2026, the date N-able's status page shows. (source: N-able) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: N-able; CISA KEV)
The Register reported on 3 September 2026 (19:08 UTC; 4 September Perth time) that the researcher known as Nightmare Eclipse dropped FalconFlank, a zero-day affecting CrowdStrike's Falcon endpoint security platform. According to the researcher, FalconFlank is a privilege escalation that abuses the Microsoft Office malicious macros remediation feature in CrowdStrike Falcon. The Register says the proof of concept works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with Phase 3 - Optimal Protection and the malicious macro removal feature enabled, as the researcher said in a GitHub README, and that security researcher Kevin Beaumont confirmed the exploit works. The researcher wrote, as quoted by The Register, that CrowdStrike would already have detections for it, so testing needs an exclusion or an obfuscated proof of concept with a changed DLL load technique. A CrowdStrike spokesperson said, as quoted by The Register: "We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting," and "Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal." (source: The Register) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: FalconFlank README on Project NightCrawler) Correction (03 Nov 2026): the card now rests on The Register's report, which carries CrowdStrike's statement, and the FalconFlank README is linked only as the researcher's account; the card date moved from 3 to 4 September 2026 (Perth time), from The Register's visible publication time of 19:08 UTC on 3 September. (source: The Register)
The Register — Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC (3 Sep 2026, 19:08 UTC)
MikroTik published an important RouterOS security update on 3–4 September 2026 (supportsec bulletin and forum notice) with details withheld, shipping builds 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21 (7.24.2 and 7.23.4 later proved to be an incomplete fix; see the correction below). On 5 September 2026 CERT Polska disclosed six coordinated CVEs and confirmed active exploitation. Highest-impact issues include CVE-2026-67276 (CERT.PL CVSS 9.2) and CVE-2026-86060 (CVSS 9.2). CVE-2026-67277 (CVSS 8.8) is unauthenticated bandwidth-test memory disclosure/crash. CVE-2026-67281 (CVSS 4.0 8.7 per CVE record) is unauthenticated WebFig /jsproxy file read that can disclose root-owned config stores. CERT.PL also lists CVE-2026-67278 and CVE-2026-67279 on the CVE details page. CERT.PL says the MikroTrick combination of two SSH flaws is being used for full takeover of devices with SSH on public networks; successful attacks creating a privileged user named ops have been seen from 82.192.72.4 since at least 2 September 2026, with 103.102.31.18 used in exploit attempts. Log IoCs include login failure for user -2 via ssh and user <name> added by ssh:-2@<ip>. Fixed releases set a Flagged marker when known compromise traces are found (absence of Flagged is not clean). Latvia's national CERT also reported increased MikroTik targeting and urged the same patched builds. Until patched: restrict SSH, WWW/WWW-SSL and bandwidth-test to trusted management nets; do not initiate TLS or built-in SSH clients from an unpatched box toward untrusted hosts. If Flagged or otherwise suspect: isolate, preserve logs/config, factory-reset and rebuild from a verified config, rotate secrets. (source: CERT Polska active-exploitation advisory) UPDATE 10 September 2026: CISA added CVE-2026-86060 and CVE-2026-67277 to KEV (dateAdded 2026-09-10). UPDATE 25 Sep 2026: CISA also added CVE-2026-67279 (SSH state-machine / behavioural-workflow bypass — the MikroTrick auth-skip half) to KEV (dateAdded 2026-09-25; federal due 28 Sep). Internet-exposed SSH / bandwidth-test paths remain the priority; patch and hunt Flagged / ops / ssh:-2 IoCs. CORRECTION (21 Oct 2026): this card earlier gave 7.24.2 and 7.23.4 as fixed builds and advised 7.23.5 on the long-term channel. CERT Polska's advisory and the CVE-2026-67278 record say 7.24.2 and 7.23.4 contained an incomplete fix for CVE-2026-67278; the fixed releases are 7.24.3 (stable) and 7.23.6 (long-term) or later, and devices on 7.24.2 or 7.23.4 must be updated again. No source we cite mentions 7.23.5. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: CERT Polska)
CERT Polska — RouterOS actively exploited (5 Sep 2026)
Google's Stable Channel Update for Desktop (4 September 2026) promotes Chrome to 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux with 12 security fixes. High-severity CVE-2026-85046 is a type confusion in V8 that Google says allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page; Google states an exploit exists in the wild. NVD Secondary CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Salvatore Gulizia (Serotav) reported it on 4 August 2026. CISA added CVE-2026-85046 to KEV (catalog entry dated 4 September 2026). WA SOC advisory 20260907001 (7 September 2026, TLP:CLEAR) covers the same Chromium V8 type confusion for Chrome, Edge, Brave and Vivaldi prior to those builds, notes CISA KEV, and says it has not received reports of exploitation on Western Australian Government networks at the time of writing. UPDATE 9 Sep: Proofpoint BlueMoon exploit kit (/n/bluemoon-exploit-kit-20260909) chains this CVE with an un-CVE'd V8 sandbox escape and Windows CVE-2026-85880; APT31 first seen 28 Aug, then other espionage clusters. Update Chrome promptly; Chromium browsers (Edge, Brave, Opera, Vivaldi) should follow vendor builds.
Chrome Stable Channel Update for Desktop (4 Sep 2026)
ConnectWise ScreenConnect™ 26.6.5 Security Patch bulletin (8 September 2026, Priority 1 High) assigns CVE-2026-84869 for a client-side condition that may allow files to be transferred and executed through an active remote Support/Access session without authorisation or Host confirmation. ScreenConnect servers are not impacted. CWE-862 Missing Authorization / CWE-269 Improper Privilege Management; CVSS 3.1 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected: ScreenConnect versions prior to 26.6.5. Remediation: upgrade to 26.6.5 or later, then reinstall Host clients and update Access agents (Cloud servers already remediated per vendor). Interim mitigation until clients are refreshed: remove TransferFiles (and TransferFilesInSession on legacy) from applicable roles/session groups — not a substitute for the patch. Earlier 3 September Guest File Transfer Advisory and Huntress late-August worm-like rogue ScreenConnect client chain (Quick Assist → wscript → VBScripts / User Run Key) remain relevant context; Shadowserver has tracked thousands of internet-exposed instances. CISA KEV listed CVE-2026-84869 on 11 September 2026 (dateAdded 2026-09-11; catalogVersion 2026.09.11); this card remains the single ScreenConnect file-transfer topic. (source: ConnectWise 2026-09-08 bulletin)
Broadcom VMSA-2026-0007 (3 September 2026, Critical) patches two privately reported host-escape-class bugs in VMware Workstation and VMware Fusion 25H2 and 26H1. CVE-2026-59346 is a VMXNET3 integer overflow (CVSSv3 up to 9.3) where a malicious actor with local administrative privileges inside a guest that uses the VMXNET3 virtual NIC may execute code on the host. CVE-2026-59347 is an HGFS stack-based buffer overflow (CVSSv3 up to 8.1) that can let a guest admin run code as the VMX process on the host. Fixed in Workstation and Fusion 26H1u1. No workarounds. Update 8 October: researcher 0xCyberstan published proof-of-concept code for CVE-2026-59346 on GitHub. It runs as a Linux kernel module inside a guest with a VMXNET3 adapter and writes transmit descriptors directly, so a 32-bit multiplication in the host's TCP segmentation offload path wraps, the buffer is undersized and guest data is written past it. The published code crashes the vmware-vmx process and powers off the VM; it is not a working code-execution exploit, and it needs admin rights inside the guest. The researcher ties it to the same code path patched for CVE-2025-41236. Broadcom does not report in-the-wild exploitation. These are desktop hypervisor bugs, not ESXi/vSphere advisories.
Exploit-DB entry 52680 (dated 3 September 2026) and Metabase advisory GHSA-w95f-x9v9-wv36 cover CVE-2026-59827: Metabase instances with an H2 database connection (including the default sample database) deserialize arbitrary Java objects from native H2 query result columns of type OTHER without validation. An authenticated user who can run native queries against an accessible H2 connection can execute OS commands on the Metabase host. Affected ranges in the exploit write-up include ≥0.58.0 <0.58.15, ≥0.59.0 <0.59.12, ≥0.60.0 <0.60.6.3, and ≥0.61.0 <0.61.1.4. Patch Metabase; remove or lock down sample/H2 connections; restrict who can run native SQL.
Exploit-DB entry 52681 (dated 3 September 2026) documents a public remote-code-execution exploit for CVE-2025-57819 in FreePBX Endpoint Manager. The flaw is an unauthenticated SQL injection in the brand parameter of /admin/ajax.php that can insert a malicious cron_jobs row and yield a reverse shell as the web user. Affected branches per the exploit write-up: FreePBX 15.x before 15.0.66, 16.x before 16.0.89, and 17.x before 17.0.3 (title tested against 17.0.2). The write-up cites CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-89 and CWE-288, NVD, and GitHub advisory GHSA-m42g-xg4c-5f3h. Upgrade Endpoint Manager / FreePBX to the fixed releases; restrict admin/ajax exposure; hunt for unexpected cron_jobs entries. Correction (25 Oct 2026): FreePBX's own advisory (GHSA-m42g-xg4c-5f3h, 28 August 2025) and the CVE record score CVE-2025-57819 at 10.0 Critical under CVSS 4.0; 9.8 is the score cited in the Exploit-DB write-up. FreePBX also says that starting on or before 21 August 2025 an unauthorised user began accessing multiple FreePBX 16 and 17 systems connected directly to the internet by exploiting this flaw, and CISA added it to its Known Exploited Vulnerabilities catalog on 29 August 2025; the card had described only a public exploit. (source: FreePBX GHSA-m42g-xg4c-5f3h; CISA KEV catalog)
