Google's Stable Channel Update for Desktop (25 August 2026) promotes Chrome 152 and ships 152.0.7977.64 on Linux and 152.0.7977.64/.65 on Windows and Mac. Among Critical fixes, CVE-2026-79290 is a use-after-free in Aura that Google rates Critical and says can let a remote attacker run code outside the browser sandbox via a crafted HTML page (fixed prior to 152.0.7977.65). CVE-2026-79282 is a Critical use-after-free in ANGLE (reported by Goodluck). WA SOC shared advisory 20260831001 (31 August, TLP:CLEAR) points operators at this Chrome update for Windows, macOS and Linux prior to 152.0.7977.65, rates the Critical issues CVSS 9.6, and says it has not received reports of exploitation on Western Australian Government networks at the time of writing. WASOC's advisory table display text for the second CVE does not match its NVD href (CVE-2026-79282); this card follows the Google release notes and that href. Patch promptly to the fixed Chrome 152 builds.
Veeam KB4905 (published 25 August 2026) documents CVE-2026-65641: an unauthenticated network attacker can coerce SMB authentication from the Veeam ONE service account. Vendor severity Critical, CVSS 4.0 score 9.3 (vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L), reported via HackerOne. Affected: Veeam ONE 13.1.0.7034 and all earlier version 13 builds. Veeam states older 12.x builds are not affected. Fixed in Veeam ONE 13.1 Patch 0 (build 13.1.0.7233) and Veeam ONE 13.0.2 Patch 1 (build 13.0.2.7159). WA SOC shared advisory 20260828001 pointed operators at this class of issue. Patch promptly; Veeam notes attackers often reverse-engineer disclosed patches.
Zoho ManageEngine security advisory for CVE-2026-74849 documents remote code execution in the ADSelfService Plus GINA client — the self-service password-reset / account-unlock portal shown on the Windows logon screen via an embedded (kiosk) browser. An unauthenticated attacker with access to the Windows logon screen may leverage the embedded browser to execute code as NT AUTHORITY\SYSTEM and fully compromise the host. Vendor severity High. Affected: builds 7000 and below. Fixed: build 7001 (fixed on 24 August 2026) by correcting error handling and hardening the embedded logon-screen browser; update via the service pack. Reported by Marouane Belabbassi and Amjad E Alhejaili via Zoho BugBounty. Industry reports (Cyber Security News 23 Sep 2026) cited a CVSS 9.8 figure. The vendor advisory page shows only severity High, but Zoho's own CVE record (Zohocorp as CNA, published 22 September 2026) scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No in-the-wild exploitation claimed in the vendor advisory. WASOC advisory 20260924001 (24 Sep 2026) lists CVE-2026-74849 as Critical CVSS 9.8 (versions 7000 and below) alongside Applications Manager CVE-2026-86708 and OpManager MSP CVE-2026-19599, and states no exploitation observed on WA Government networks at time of writing — WASOC’s 9.8 matches the score on Zoho’s CVE record. (sources: ManageEngine CVE-2026-74849 advisory; WASOC 20260924001) Correction (23 Oct 2026): this card said the CVSS 9.8 figure was not the vendor's and recorded only the advisory page's High rating. Zoho's own CVE record for CVE-2026-74849 (Zohocorp as CNA, published 22 September 2026) scores it CVSS 3.1 9.8. (source: CVE-2026-74849 record (cve.org))
ManageEngine — CVE-2026-74849 ADSelfService Plus GINA client RCE
Unauthenticated remote code execution in JetBrains TeamCity On-Premises via the agent polling protocol. ASD's ACSC warned that the flaw is under active attack against TeamCity On-Premises servers in Australia, according to iTnews (25 Aug 2026). All On-Premises versions are affected. TeamCity Cloud is not. Patch to 2025.11.7 or 2026.1.3, or apply the vendor security patch plugin if you cannot upgrade. UPDATE 24 Sep 2026: BleepingComputer reports CISA updated the KEV entry for CVE-2026-63077 (already catalogued 5 Aug 2026) to flag ransomware-gang abuse — fourth TeamCity KEV item since Oct 2023 also tied to ransomware; Shadowserver ~160 internet-exposed unpatched hosts (down from ~700). (sources: ASD's ACSC advisory; as reported by iTnews; BleepingComputer) Correction (24 Oct 2026): the ACSC's exploitation warning is now attributed through iTnews's report, because the ACSC page cannot be read from Cyberstack. (source: iTnews)
Zscaler's 24 August 2026 CVE record describes multiple Client Connector flaws that allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context. Zscaler scored it 9.1 (CVSS 3.1). The CNA points administrators to the 2026 Client Connector app release summary for fixed builds. Affected version strings in that record include Windows before 4.6.0.457 / 4.7.0.317 / 4.8.0.232 / 4.9.0.372, macOS before 4.5.2.312 / 4.7.0.292 / 4.8.0.191, Linux before 3.7.2.64 / 4.2.1.64, Android and ChromeOS before 4.2, and iOS before 4.5.1. Confirm the exact build from the vendor release summary before declaring a fleet patched. Zscaler's CVE records (24 Aug 2026) also cover CVE-2026-59564 (authentication bypass in Client Connector to Portal communications), CVE-2026-59567 (local privilege escalation) and CVE-2026-59565 (buffer overflow causing local and kernel denial of service on Windows). Not in CISA KEV at last check.
Oracle Critical Patch Update (January 2026) lists CVE-2026-21962 in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS. Supported affected versions: 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. NVD rates CVSS 10.0. Unauthenticated network access via HTTP. Apply the January 2026 CPU for the plug-in builds you run.
Origin Energy confirmed unauthorised access to personal information of approximately 900,000 current and former customers in July 2026. Categories include name, address, date of birth, contact phone, account details, and partial payment data (last four digits of a credit card or last three of a bank account). On 21 August 2026 Origin said a completed review found about 60 customers had full bank account numbers accessed, about 100 had an ID document number accessed (number only, no scans), and about 15,000 had government concession-scheme numbers accessed. Origin told ABC the alleged attacker had not publicly leaked customer data. The company is working with ASD's ACSC, the National Office of Cyber Security, AFP and OAIC; a criminal investigation continues. Earlier reporting linked the incident to a former Accenture Manila call-centre worker; Accenture declined to comment to ABC. UPDATE (23 Oct 2026): AAP reports that at Origin's annual meeting on 14 October 2026 chairman Scott Perkins said: 'We have seen no evidence of the information being published on the internet or the dark web to date; however we note this risk remains and affected customers will need to remain vigilant to any suspicious activity or scams.' (source: AAP)
Unauthenticated OS command injection in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. NVD: crafted SMTP requests can run commands as the zimbra user. CERT Polska reported active exploitation. Patch to 10.1.20. UPDATE 30 Sep 2026: Microsoft Security Blog publishes tracking/hunting notes for unauthenticated command injection on internet-facing mail servers including this CVE. If you cannot upgrade, remove zimbra-snmp / disable snmp_notify and hunt per CERT Polska. UPDATE 1 Oct 2026: Microsoft Security Blog (30 Sep) details post-exploitation observed between patch availability (Zimbra 10.1.20, 20 Jul 2026) and public disclosure (13 Aug 2026) — including Jul 28–Aug 7 out-of-band probes via collaborator/OAST domains, JSP web shells across Jetty/mailboxd paths, wget/curl payload fetch, cron/systemd/memfd persistence, mailbox/authentication-data collection, and privilege escalation abusing Zimbra sudo-authorized helpers (zmmailboxdmgr writable log → PAM symlink → pam_exec → passwordless sudo for the zimbra account). THN 30 Sep reports the same Microsoft research. Cyberstack does not reproduce exploit construction. Hunt and contain per Microsoft + CERT Polska; patch remains 10.1.20; if upgrade delayed remove zimbra-snmp / disable snmp_notify.
Oz Hair and Beauty's official statement says its online purchase and order platform was briefly accessed by an unauthorised third party. Limited personal information of some customers who purchased before August 2026 was involved: full name, email and/or mobile, and purchase data (currency, total spend, purchase location, customer creation date). The company says credit cards, passwords, payment information and invoice details were not accessed. It reported the incident to ACSC, OAIC and New Zealand's Office of the Privacy Commissioner. Customers not emailed by 22 August 2026 were, on that statement, not identified as impacted on the investigation to date. The company has not published a count of affected records.
Kaspersky ICS CERT (KLCERT-26-057): an unauthenticated attacker with network access to TrueConf Server on TCP 4307 can call an undocumented function and run an arbitrary script. Affects 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and earlier than 5.3. NVD CVSS 9.8. Related CVE-2026-72530 is a code-injection issue in the same product line. Patch to the fixed builds and do not expose 4307 to the internet.
Cloud Software Group bulletin CTX696939 (19 August 2026, Critical) covers an authentication bypass using an alternate path in customer-managed NetScaler ADC and NetScaler Gateway. CVSS v4.0 9.3. It applies when the appliance is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server; on some later 14.1/13.1 builds only when a SAML action is also configured. Not Citrix-managed cloud. No workaround. Patch to 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 FIPS/NDcPP, as applicable. Secure Private Access Hybrid using customer-managed NetScaler also needs those builds. Updated 4 Sep 2026 (BleepingComputer, 4 September 11:25 pm Perth): BleepingComputer reports Previdian honeypot sensors saw requests matching a public PoC on 3 September from three source IPs geolocated to Australia, the United States and Germany — evidence of exploitation attempts, not confirmed successful compromise of production systems. The Centre for Cybersecurity Belgium also warned of exploitation attempts the same week. Citrix’s August bulletin had not yet flagged active exploitation. Updated 7 Sep 2026 (WA SOC): WA SOC advisory 20260907003 (7 September 2026, TLP:CLEAR) covers CVE-2026-19490 at CVSS 9.3 for the same build floors, and reports no exploitation on Western Australian Government networks at the time of writing. Updated 9 Sep 2026 (CISA): CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog on 9 September 2026 (due 12 September 2026 for FCEB under BOD 26-04, including forensic triage requirements). Patch floors unchanged: 14.1-73.32 / 13.1-63.21 and FIPS mates. Correction (26 Oct 2026): the BleepingComputer, WA SOC and CISA reports, all later than Citrix's 19 August bulletin, now carry Updated lines; the card date stays 19 August 2026. The WA SOC and CISA links now point to the addresses those pages have moved to. (source: Citrix; BleepingComputer; WA SOC; CISA)
Same CTX696939 bulletin: memory overflow that can cause unpredictable behaviour or denial of service when SIP ALG is enabled on a Large Scale NAT (LSN) group. CVSS v4.0 8.8. Customer-managed NetScaler ADC and Gateway only. No workaround. Same patched builds as CVE-2026-19490: 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 FIPS/NDcPP.
