Cisco Secure Email Gateway Vulnerability: Patch Now

By Editorial Team | September 17, 2026
A critical Cisco Secure Email Gateway vulnerability lets one crafted email grant root access, no login needed. Active exploitation confirmed.

A critical Cisco Secure Email Gateway vulnerability, CVE-2026-76461 (CVSS 9.8), lets an attacker gain root access to the appliance by sending a single crafted email, no login or admin access required. Cisco confirmed active exploitation and published its advisory September 14; CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, and…

Read More

Check Point VPN Certificate Vulnerability: Patch Now

By Editorial Team | September 16, 2026
A Check Point VPN certificate vulnerability pair (CVSS 9.8) allows pre-auth RCE. Dutch NCSC warns exploitation is imminent; patch today.

Check Point disclosed a Check Point VPN certificate vulnerability pair, CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8, on September 9, and the Dutch National Cyber Security Centre has since warned that large-scale exploitation is likely imminent, even though Check Point itself has not yet observed attacks in the wild. Both flaws allow unauthenticated remote code execution…

Read More

Windows Defender ShieldCrash Exploit Bypasses Patch

By Editorial Team | September 15, 2026
A new Windows Defender ShieldCrash exploit grants SYSTEM access on fully patched systems, defeating the fix Microsoft shipped days earlier.

A new Windows Defender ShieldCrash exploit went public on September 9, granting SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server systems, including machines that had already installed Microsoft’s own September Patch Tuesday fix for the previous bug in the same family. No CVE has been assigned, and no patch or official…

Read More

SAP Kernel RCE Vulnerability Hits 10,000+ Systems

By Editorial Team | September 14, 2026
SAP Kernel RCE Vulnerability Hits 10,000+ Systems

A maximum-severity SAP kernel RCE vulnerability, tracked as CVE-2026-44756 and named OVERPASS by Onapsis Research Labs, lets an unauthenticated attacker reach shared SAP kernel code before any session authenticates — and it is reachable over three separate protocol paths at once. SAP patched the CVSS 10.0 flaw on September 8, 2026, as part of its…

Read More

N-able N-central RCE Vulnerability Hit Again

By Editorial Team | September 11, 2026
N-able N-central RCE Vulnerability Hit Again

An N-able N-central RCE vulnerability has forced the vendor to ship its fourth emergency hotfix in five weeks, and Huntress investigators say a customer’s server — already patched against an earlier round of flaws — was compromised a second time anyway. Tracked as CVE-2026-86218 with a maximum CVSS score of 10.0, the flaw hits a…

Read More