[CRITICAL] – NetScaler Authentication Bypass Added to CISA KEV
CISA added an actively exploited NetScaler authentication bypass to KEV; exposed gateway and AAA deployments need urgent updates.
[CRITICAL] – Cisco Talos Tracks Active Secure FMC Exploitation
Cisco reports active exploitation of two Secure FMC flaws, including a CVSS 10 authentication bypass enabling root access.
[HIGH] – Google Patches Actively Exploited Chrome V8 Flaw
Google issued Chrome updates for an exploited V8 out-of-bounds write; update desktop Chrome to the patched Stable release.
[CRITICAL] – CISA Adds N-able N-central RCE to KEV Catalog
CISA added a pre-authentication N-central remote-code-execution flaw to KEV; self-hosted administrators should apply N-able's hotfix.
[MEDIUM] – Calif Discloses Mitigated WeChat Zero-Click Worm Demo
Calif demonstrated a zero-click WeChat account-takeover worm; it says Tencent has mitigated the exploit.
[CRITICAL] – Sangoma Switchvox RCE Added to CISA KEV After Active Exploitation
CISA-listed, actively exploited Switchvox SQL injection can enable unauthenticated remote code execution.
[CRITICAL] – FreeIPA Flaw Enables Unauthenticated Administrator Access
A critical FreeIPA flaw can give an unauthenticated LDAP client administrator-group membership.
[CRITICAL] – Microsoft Patches Two Actively Exploited Windows Elevation Flaws
Microsoft addressed two Windows privilege-escalation flaws that CISA added to the KEV Catalog on September 8.
[HIGH] – New Linux HAProxy Backdoor Toolkit Targets South Korean Organizations
Rapid7 details a stealthy Linux toolkit targeting South Korean automotive and media organizations.
[CRITICAL] – StyleSmuggler Active Magento and Adobe Commerce Zero-Day RCE
Sansec reports active exploitation of an unauthenticated Magento and Adobe Commerce code-execution chain.