Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
993 vulnerabilities patched by Microsoft in the September 2026 Patch Tuesday release. Severity Breakdown Critical: 132 Important: 861 Actively Exploited (2) CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability CVSS 7.8 | Windows Update Stack | Actively Exploited Microsoft Advisory CVE-2026-85880 — Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability CVSS 7.8 | Windows ALPC | Actively Exploited Microsoft Advisory Exploitation More Likely (58) CVE-2026-69525 — Remote Desktop Services Remote Code Execution Vulnerability (CVSS 9.8, Windows Remote Desktop Services) CVE-2026-69730 — Windows DNS Server Remote Code Execution Vulnerability (CVSS 9.8, Windows DNS) CVE-2026-69854 — Spring Cloud Azure Elevation of Privilege Vulnerability (CVSS 9.0, Spring Cloud Azure) CVE-2026-69676 — Windows Kerberos Remote Code Execution Vulnerability (CVSS 8.8, Windows Kerberos) CVE-2026-72940 — Windows Schannel Remote Code Execution Vulnerability (CVSS 8.8, Windows Schannel) CVE-2026-69857 — Azure Cosmos DB Spoofing Vulnerability (CVSS 8.5, Azure Cosmos DB) CVE-2026-70342 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 8.1, Windows Ancillary Function Driver for WinSock) CVE-2026-72936 — Windows SMB Client Remote Code Execution Vulnerability (CVSS 8.1, Windows SMB Client) CVE-2026-68876 — Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (CVSS 8.0, Windows Program Compatibility Assistant Service) CVE-2026-68880 — Windows Win32k Elevation of Privilege Vulnerability (CVSS 8.0, Windows Win32K) CVE-2026-69301 — Windows Win32k Elevation of Privilege Vulnerability (CVSS 8.0, Windows Win32K) CVE-2026-69623 — Windows HTTP Print Provider Remote Code Execution Vulnerability (CVSS 8.0, Windows HTTP Print Provider) CVE-2026-69714 — Windows Device Association Service Elevation of Privilege Vulnerability (CVSS 8.0, Windows Device Association Service) CVE-2026-69777 — Windows DHCP Client Elevation of Privilege Vulnerability (CVSS 8.0, Windows DHCP Client) CVE-2026-69277 — Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Local Security Authority Server (lsasrv)) CVE-2026-69391 — Windows Broker Infrastructure Service Elevation of Privilege Vulnerability (CVSS 7.8, Windows Broker Infrastructure Service) CVE-2026-69436 — Windows State Repository Service Elevation of Privilege Vulnerability (CVSS 7.8, Windows State Repository Service) CVE-2026-69450 — Windows Error Reporting Elevation of Privilege Vulnerability (CVSS 7.8, Windows Error Reporting) CVE-2026-69459 — Windows Power Dependency Coordinator Elevation of Privilege Vulnerability (CVSS 7.8, Windows Power Dependency Coordinator) CVE-2026-69467 — Microsoft Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Graphics Component) +38 more Executive Summary Microsoft’s September 2026 Patch Tuesday is one of the largest on record, addressing 993 vulnerabilities across the Windows ecosystem, Azure cloud services, Office suite, SQL Server, and numerous supporting components. Of these, 132 are rated Critical and 58 carry Microsoft’s “Exploitation More Likely” designation, signaling a broad and urgent patching cycle. Two vulnerabilities are confirmed under active exploitation: CVE-2026-81963, an elevation of privilege in the Windows Update Stack, and CVE-2026-85880, an elevation of privilege in Windows ALPC. Both carry a CVSS score of 7.8 and provide local privilege escalation, meaning they are likely being chained with initial access vectors in real-world attacks. These two zero-days should be treated as the highest priority for endpoint teams, particularly on systems where standard users operate and lateral movement risk is elevated. ...
331 vulnerabilities across 15 products scored HIGH or above on September 08, 2026. 🔴 CRITICAL: 4 🟠 HIGH: 327 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin. 🔴 [CRITICAL] adobe/adobe_experience_manager_as_a_cloud_service 1 CVE | CVSS 3.1: 9.9 | AAS 13.1 ...
9 vulnerabilities across 6 products scored HIGH or above on September 07, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 8 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin. 🔴 [CRITICAL] adobe/adobe_commerce 1 CVE | CVSS 3.1: 10.0 | AAS 14.1 ...
3 vulnerabilities across 3 products scored HIGH or above on September 06, 2026. 🟠 HIGH: 3 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. 🟠 [HIGH] shabti/frontend_admin_by_dynamiapps 1 CVE | CVSS 3.1: 9.8 | AAS 10.9 cpe:2.3:a:shabti:frontend_admin_by_dynamiapps:*:*:*:*:*:*:*:* Frontend Admin by DynamiApps (WordPress Plugin) — Critical Authentication Bypass ...
17 vulnerabilities across 13 products scored HIGH or above on September 05, 2026. 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. 🟠 [HIGH] coollabsio/coolify 1 CVE | CVSS 4.0: 9.2 | AAS 11.7 cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:* Coolify, the open-source self-hosting platform by coollabsio, is affected by one high-severity vulnerability (CVE-2026-86117, CVSS 9.2) in versions through 4.3.17. The flaw is an authentication bypass in the OAuth callback handler that allows an attacker to sign into any existing account by simply registering the victim’s email address on a supported OAuth provider, completely bypassing password and two-factor authentication controls. This vulnerability is considered exploitable and is relevant to any organization running a self-hosted Coolify instance with OAuth login enabled. ...
20 vulnerabilities across 15 products scored HIGH or above on September 04, 2026. 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. 🟠 [HIGH] ibm/operational_decision_manager 1 CVE | CVSS 3.1: 9.8 | AAS 11.4 cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 8.11.0.1) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 8.12.0.1) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.0.0.1) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.5.0.0) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.6.0.0) IBM Operational Decision Manager versions 8.11.0.1 through 9.6.0.0 is affected by one critical vulnerability (CVE-2026-18658, CVSS 9.8) involving an unauthenticated SQL injection flaw that can be chained to achieve remote code execution via web shell deployment. Organizations using ODM for business rule automation should treat this as an urgent priority, as no authentication is required to exploit the issue and it provides full system compromise. ...
27 vulnerabilities across 15 products scored HIGH or above on September 03, 2026. 🟠 HIGH: 27 🟠 [HIGH] google/chrome 8 CVEs | CVSS 3.1: 9.6 | AAS 11.4 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (< 152.0.7977.82) Google Chrome is affected by eight vulnerabilities addressed in the latest stable channel update, including multiple high-severity issues. The most critical, rated CVSS 9.6, involves improper input validation in the Transactions Platform on iOS that could allow a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. Additional flaws span multiple Chrome components and are considered exploitable. ...
21 vulnerabilities across 13 products scored HIGH or above on September 02, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🔴 [CRITICAL] craftcms/cms 5 CVEs | CVSS 4.0: 9.2 | AAS 12.2 cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:* Craft CMS versions prior to 5.10.11 are affected by five vulnerabilities, including at least one rated CRITICAL with a CVSS 4.0 score of 9.2. The most severe issue allows attackers to gain full administrator privileges by registering with a deactivated admin’s email address, exploiting a flaw where the admin flag is not properly cleared during user registration. This is exploitable in environments where public registration is enabled and email verification is disabled. Security teams running Craft CMS should update to version 5.10.11 or later immediately and review the vendor advisory at the link above for details on all five issues. Organizations should also audit their Craft CMS instances for any unauthorized admin accounts that may have been created through this registration bypass. ...
25 vulnerabilities across 12 products scored HIGH or above on September 01, 2026. 🟠 HIGH: 25 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🟠 [HIGH] predis/predis 1 CVE | CVSS 3.1: 9.8 | AAS 11.4 cpe:2.3:a:predis:predis:*:*:*:*:*:*:*:* (>= 3.0.0-RC1, < 3.3.0) Predis, a popular Redis and Valkey client library for PHP, is affected by one critical-severity vulnerability (CVE-2026-84372, CVSS 9.8). Versions 3.0.0-RC1 through 3.2.x contain a CRLF injection flaw in pipeline handling for aggregate cluster and replication connections, where attacker-controlled keys or values containing CRLF sequences can be interpreted as additional Redis commands due to improper parsing of serialized RESP buffers. This effectively allows command injection against the Redis backend and is considered exploitable. Any organization running Predis 3.0.0-RC1 or later in production should upgrade to version 3.3.0 immediately and review the vendor advisory at the linked GitHub commit for additional remediation details. ...
14 vulnerabilities across 11 products scored HIGH or above on August 31, 2026. 🟠 HIGH: 14 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🟠 [HIGH] zhenorzz/goploy 1 CVE | CVSS 3.1: 9.6 | AAS 11.4 cpe:2.3:a:zhenorzz:goploy:*:*:*:*:*:*:*:* Goploy, an open-source automation deployment system by zhenorzz, is affected by one critical vulnerability (CVE-2026-53552, CVSS 9.6) involving broken access control across multiple API endpoints. The flaw allows a user with the manager role to manipulate projects outside their assigned namespace by supplying arbitrary project or file row IDs, because the backend fails to verify namespace ownership before acting on requests. A proof-of-concept exploit is publicly available. Organizations running Goploy version 1.17.5 or earlier should review the vendor advisory at the linked GitHub Security Advisory, apply any available patches or mitigations immediately, and audit project access logs for signs of unauthorized cross-namespace activity. ...