Tag
8 articles tagged #Patch Management.
P.01Two critical, unauthenticated vCenter flaws let attackers bypass login entirely and run code on the management plane. Exploitation started five days after the patch shipped. Here's what's affected and how to check for compromise.
P.02A stack-based buffer overflow in Windows DNS Server lets an unauthenticated attacker run code with a single crafted packet, no user interaction required. It hasn't been seen exploited yet, but it has the exact shape of a bug that gets weaponized fast. Here's what to patch and in what order.
P.03A use-after-free in Windows' AFD.sys networking driver is on CISA's Known Exploited Vulnerabilities list with an August 25 deadline. Lazarus has been using it since July to hit defense contractors. Here's what it is and what to patch.
P.04An unauthenticated attacker can inject SQL through Metabase's password-reset flow and walk out with full admin access. CVSS 10.0, on CISA's KEV list since August 11. Here's what's affected and how to patch it.
P.05A heap-buffer bug in Progress Kemp LoadMaster's escape_quotes() function lets an unauthenticated attacker run commands on the load balancer itself. CISA confirmed active exploitation on August 7. Here's what's affected and how to patch it.
P.06A deserialization flaw in TeamCity's agent polling protocol lets an attacker with no credentials run commands as the build server. CISA confirmed active exploitation on August 5. Here's what's affected and how to patch it.
P.07CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4. Unlike July's Langflow flaw, this one needs no credentials at all. Here's how the two-endpoint chain works and what to patch.
P.08N-able's first fix for an N-central auth bypass was incomplete. The follow-up flaw, CVE-2026-18577, is now under active exploitation and lets attackers pivot from one RMM server into every endpoint it manages. Here's what to patch and how to check if you were hit.