01Two pre-auth code-execution flaws sit in the certificate-processing step every VPN negotiation runs before a user ever authenticates. Check Point published two Critical (CVSS 9.8) advisories for VPN certificate-handling flaws discovered internally and reachable before authentication completes: CVE-2026-85103, a heap overflow in certificate ASN.1 decoding on the Security Gateway, Spark Firewall and every Security Management Server, whether or not it runs VPN, and CVE-2026-85102, an improper-certificate-validation flaw enabling unauthenticated RCE on the Security Gateway and Spark Firewall. CVE-2026-85102 is now under confirmed active exploitation against Spark Firewall customers globally since 2026-09-12. Check Point's interim rule-based mitigation for Site-to-Site and Remote Access VPN does not apply to the locally managed Spark Firewall, where patching is the only control. →
02Six espionage clusters ran the identical click-to-SYSTEM exploit kit within days of each other; Proofpoint calls it the same code, not parallel development. Proofpoint documents BlueMoon, an exploit kit chaining a Chrome V8 patch-gap zero-day (CVE-2026-85046) with a WebAssembly V8-sandbox escape (CVE-2026-87491) and a Windows kernel ALPC/WNF local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain, independently adopted by TA412/APT31, three new China-nexus clusters, a fifth operator (UTA0560) and a sixth (UTA0565) Volexity later confirmed, targeting US, Vietnamese and Southeast Asian government, aerospace and manufacturing victims, with Government also named among NGO, Consulting, Finance, Mining and Commodity Trading targets by NCSC Switzerland. All three CVEs are patched, but the kit's persistence mechanisms (malicious browser extensions, DLL sideloading, scheduled tasks) survive an OS/browser patch untouched. →
03Two maximum-severity SAP kernel flaws are reachable through the same ports every SAP GUI and RFC client needs; network segmentation alone will not close them. SAP's 8 September 2026 Patch Day fixed CVE-2026-44756 (OVERPASS, CVSS 10.0), an unauthenticated memory-corruption flaw in kernel Extended Passport processing reachable via the web tier, SAP Dispatcher or RFC, and CVE-2026-58240 (S4GET, CVSS 9.8), an unauthenticated Message Server trust-bypass reachable on the port every SAP GUI client uses; both yield unauthenticated remote code execution across the SAP kernel-based product line. Neither is yet confirmed exploited, but Onapsis found over 10,000 internet-facing SAP interfaces, and since 2026-09-15 an open-source SAP exploitation toolkit, SAPMAP, has carried proof-of-concept exploits for both flaws. →
04Google ships an emergency Chrome fix for a seventh actively exploited V8 zero-day this year. Google's Chrome 153 stable release (2026-09-08) fixes CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine that Google confirms is already being exploited via a crafted HTML page. CERT-FR and NCSC-NL both flagged the CVE within a day of release; every Chromium-derived browser needs the equivalent update. →
05A months-old Fortinet CAPWAP bug reaches CISA KEV alongside an AI-assisted post-exploitation RAT built specifically for FortiGate. CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on 2026-09-09: an unauthenticated heap overflow in the CAPWAP daemon that FortiOS and FortiSwitchManager use to manage wireless access points. SOCRadar reports a likely Russian-speaking operator has exploited it since at least July 2026 against over 30,000 FortiGate IPs, dropping PivotC2, an AI-assisted RAT that harvests device credential stores. →
Proofpoint documents BlueMoon, a newly named exploit kit chaining a Chrome V8 JIT type-confusion bug (CVE-2026-85046) with an uncredentialed V8 sandbox escape and a Windows kernel ALPC/WNF heap-overflow local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain (Proofpoint, 2026-09-08). The V8 bugs were a patch-gap zero-day: "the change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026" (Proofpoint, 2026-09-08), a nearly four-week window during which the public upstream diff let an exploit developer reverse-engineer and weaponize the bug before Chrome's stable channel shipped it; CVE-2026-85880 was separately patched by Microsoft as part of its September 2026 Patch Tuesday updates (The Hacker News, 2026-09-09); the referenced 2026-09-09 Windows entry covers Microsoft's own MSRC confirmation that it was exploited in the wild. After the browser-side chain achieves code execution and escapes the renderer sandbox, a reflectively loaded DLL fingerprints the host to decide whether to run the kernel LPE against a specific list of Windows builds, Proofpoint's own table names Windows 10 1809/2004/20H2/21H1/21H2/22H2, Windows 11 21H2's initial release build, and Server 2019/2022, a wider list than Microsoft's own advisory for this CVE, which describes the legacy line only and states it does not affect Windows 11 (Contradiction, unresolved here), then a process-injection stub runs an operator-supplied command inside the Chrome broker process, by default a plain curl download-and-execute, a deliberately crude step Proofpoint reads as evidence the developer traded stealth for speed. Four distinct espionage clusters adopted the identical kit within days of each other by Proofpoint's original count (a fifth, documented below, started 2026-09-01, within that same one-week span), each with its own delivery and payload: TA412/APT31 (from 2026-08-28) used student-internship and academic-conference spearphishing against US NGOs, mining and commodity-trading firms to install a malicious Chromium extension disguised as "Google Gemini" (GemStone), using an HMAC-forgery technique, named GhostChrome-X by outside researchers (The Hacker News, 2026-09-09), against Chrome's Secure Preferences integrity check so the extension survives the browser's own unauthorized-extension protection; GemStone keylogs, steals cookies/session storage, screenshots on keyword match and polls its C2 every 30 seconds to 60 minutes. UNK_LateNight (from 2026-09-02) targeted US aerospace/defense firms with B2B/RFQ lures to sideload the ShadowPad backdoor via a scheduled task. UNK_DoubleCheck (from 2026-09-02) phished a Vietnamese manufacturer from a compromised Southeast Asian government mailbox, obfuscating its loader and staging a second DLL from a Cloudflare R2 bucket. UNK_QuietRacket (from 2026-09-03) targeted government, consulting and financial-sector organizations in Indonesia and Singapore with conference-themed lures, resolving C2 entirely through DNS-over-HTTPS TXT-record lookups to a Cloudflare Worker. A Proofpoint researcher assessed the kit as shared rather than independently developed: "There's no way that this is parallel development," and "The code is practically identical, even the variable naming, the commentary. It's the same kit. One hundred percent." How the groups obtained it is undetermined, since Proofpoint could not say whether it came from a common contractor, was distributed by the state or spread through another shared channel (Mark Kelly, Proofpoint, via The Record, 2026-09-09). Patching Chrome and Windows closes the entry vector but removes nothing already installed, the GemStone extension, ShadowPad's DLL-sideload persistence, and the other clusters' scheduled tasks all survive a patch untouched.
Triage: a process tree rooted at the browser (browser → command shell → curl or a download utility → a newly dropped executable) is the chain's own crude final stage and a strong discriminator on its own; a scheduled task created immediately following a browser-initiated download narrows it further, since legitimate browser activity does not normally create scheduled tasks.
The change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026.
The exploit first gains arbitrary read/write within the V8 sandbox through the Type confusion vulnerability (CVE-2026-85046), then combines a separate WebAssembly defect to escape the V8 sandbox (CVE-2026-87491). It then exploits a third vulnerability in the Windows kernel (CVE-2026-85880)
Volexity tracks this malware as GRIMWEDGE.
constructing a victim-specific URL using the victim device’s hostname
with a tab-delimited body containing the victim’s domain, username, and any command output from the loop’s previous run. HTTP responses to POST requests are evaluated as JScript code.
NCSC Switzerland's own Cyber Security Hub advisory lists this chain's targets so far as "NGO, Government, Consulting, Finance, Mining, Commodity Trading" while stating no case has yet been reported in Switzerland (NCSC Switzerland, 2026-09-12). Volexity's own technical write-up, cited in that advisory, supplies the exploit chain's previously missing middle link: "the exploit first gains arbitrary read/write within the V8 sandbox through the Type confusion vulnerability (CVE-2026-85046), then combines a separate WebAssembly defect to escape the V8 sandbox (CVE-2026-87491)," before the Windows kernel flaw completes the escape to full code execution in the browser process (Volexity, 2026-09-09). Volexity names a fifth operator, UTA0560, which reached the chain through a reflected cross-site-scripting flaw on a legitimate US university website, unlike JungleBamboo's own delivery via attacker-registered domains fronted by Cloudflare Tunnels, and deployed GRIMWEDGE, an in-memory JScript backdoor under 250 lines that runs as an evaluated string inside msiexec.exe. Delivery chains through a dropper (msgbox.exe) that sideloads wsc.dll; wsc.dll beacons to a per-victim URL keyed on hostname to fetch and launch the next-stage MSI payload via msiexec.exe, and GRIMWEDGE itself, once running, instead sends HTTP POST requests carrying the victim's domain, username and prior command output to a single fixed command-and-control URL, with server responses evaluated as script; GRIMWEDGE supports ten commands including file read/upload, process control and command execution. Volexity separately documents JungleBamboo's (APT31/TA412) own payload chain: a loader it names SUPERSTOMP tampers with Chrome's Secure Preferences file, stripping and forging the per-preference integrity values to smuggle in a malicious extension impersonating "Google Gemini" past Chrome's own tamper checks; the resulting extension, LONGTALE, keylogs every keystroke and form or clipboard value across all open tabs, steals cookies and web-storage tokens, and takes keyword-triggered screenshots, exfiltrating collected data roughly every 30 seconds. This mechanism and disguise match Proofpoint's own GemStone/GhostChrome-X description of the same actor's tooling closely enough that the two vendor names may describe the same artifact rather than two distinct ones; neither vendor's own report confirms this directly, so both names are carried here without merging them.
An unexpected process loading wsc.dll and beaconing outbound over HTTPS to a per-hostname URL path, followed shortly by an msiexec.exe process installing whatever that beacon returned, is UTA0560's dropper-stage signature; a msiexec.exe process making repeated outbound HTTP POST requests to the same fixed destination with no corresponding user-initiated software installation is the discriminator for the GRIMWEDGE backdoor stage that follows it. A Chrome extension whose Secure Preferences integrity hash was set by a process other than Chrome itself, or that requests clipboard and all-tab permissions while impersonating a well-known AI-assistant name, is JungleBamboo's LONGTALE signature. Both persistence mechanisms, like the original entry's, survive the underlying browser and OS patches untouched.
A sixth cluster has been documented running this chain. Volexity's follow-up reporting names UTA0565, a China-nexus actor that exploited all three flaws on 3 and 4 September 2026, while every one of them was still unpatched (Volexity, 2026-09-21). The exploit kit itself is essentially unchanged: the embedded stage binaries are identical to the previously reported payloads, and the core exploit logic, version checks and stage sequencing are the same.
What differs is the delivery, and it is the part worth hunting on. Rather than the redirect-through-a-legitimate-site route the earlier operators used, UTA0565 sent phishing mail linking to domains it had registered itself to impersonate China Digital Times and the Center for American Progress, one lure urging support for an imprisoned Hong Kong activist and sent to Asian government entities, the other masquerading as the US policy institute. The one page still live when Volexity analysed it loaded most of its content from the legitimate site it copied and added the exploit components in a hidden, zero-sized iframe, so the page a victim saw was the real organization's content. The other site was already offline by then and is confirmed only as a visual clone of the outlet it impersonated, from a cached scan of the host that served it, so the same delivery mechanism is inferred there rather than observed. The final stage also changed: instead of a shell command that fetched and ran the payload, the kit now downloads the executable in-process, strips its Mark of the Web, and launches it through the Windows shell using COM, which removes both the command-line artifact and the zone-identifier evidence that earlier variants left behind.
The payload is a family Volexity had not previously documented and names CLEANGULP: a C binary obfuscated with control-flow flattening and indirect calls, installed under the user's local application-data path and persisted by a scheduled task, both named after a Microsoft input-method-editor component. Volexity assesses with high confidence that it supports command execution, process listing, file upload and download, and execution of beacon object files. Its command-and-control traffic runs over plain HTTP to a domain typosquatting a news publisher, with request and response bodies encrypted with AES-256-GCM and then encoded in a custom Base64 alphabet, the encryption key being derived from that alphabet string itself. Volexity pivoted on the registration pattern of the domains involved and assesses with medium confidence that several further domains, spanning spoofed media organizations, halal restaurant search sites and corporate training organizations, belong to the same campaigns.
For defenders the hunt moves one step earlier in the chain than the previous coverage suggested. A scheduled task and an executable both carrying an input-method-editor name under the user's local application-data tree, with no corresponding software deployment, is the on-host artifact; outbound HTTP carrying opaque binary bodies to a domain that is one transposition away from a news publisher the organization actually reads is the network one. Because the payload is launched through COM after an in-process download, process-lineage detections keyed on a browser spawning a command interpreter will not see this variant.
Proofpoint's researcher says the six clusters used the same kit, not that it was deliberately handed out. The Record reports that how the groups obtained the exploit within days of each other remains unclear, and that Proofpoint could not determine whether it came from a common contractor, was distributed by the state or spread through another shared channel (Mark Kelly, Proofpoint, via The Record, 2026-09-09). The analysis had described the adoption as deliberate distribution and now describes it as a shared kit reaching the clusters through an undetermined channel.
Check Point created two Critical-severity advisories on 2026-09-07, disclosed them with the fixes on 2026-09-09 and revised them on 2026-09-18 (sk1000118) and 2026-09-24 (sk1000117), for its VPN certificate-handling code, both triggered during certificate processing before authentication completes and both discovered internally with no external researcher credited (Check Point, advisory sk1000118, 2026-09-07; sk1000117, 2026-09-07). CVE-2026-85103 (CVSS 9.8) is "a heap overflow in the VPN certificate ASN.1 decoding flow" that "may allow an attacker to remotely execute arbitrary code on the Security Management Server and Security Gateway", and Check Point now adds that every Security Management Server deployment is vulnerable regardless of configuration, including one where VPN is not in use (Check Point, sk1000118). CVE-2026-85102 (CVSS 9.8, CWE-295 improper certificate validation) is an authentication-bypass-to-RCE in Remote Access and Site-to-Site VPN negotiation: "improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway" (Check Point, sk1000117), reachable against the Security Gateway and Spark Firewall. Affected: R81.20, R82, R82.10, and the end-of-support R80/R80.10/R80.20/R80.30/R80.40/R81/R81.10 lines and their .x builds; R82.20 is confirmed not affected. Both vulnerabilities were discovered internally by Check Point; there were no reports of active exploitation as of the 2026-09-09 disclosure (Forkast News, 2026-09-09), but CVE-2026-85102 is now under confirmed active exploitation (see the Update below); this is a distinct certificate-processing defect from the June 2026 IKEv1 key-exchange flaw (CVE-2026-50751) already on CISA KEV. Fix is delivered via Check Point LivePatch Take 24 (automatic if enabled) or Jumbo Hotfix Accumulator (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+, R81.10 Take 190+), plus dedicated Spark Firewall builds (R82.00.10 Build 2325+, R81.10.17 Build 4968+). No workaround exists for the locally-managed Spark Firewall. For a system that cannot take the fix, Check Point's interim mitigation replaces the VPN implied rules with explicit ones: for Site-to-Site VPN, UDP/500 and UDP/4500 allowed only from the specific peer addresses, and for Remote Access VPN, explicit rules for the required services restricted to the client address ranges where that is possible (Check Point, sk1000117).
A heap overflow in the VPN certificate ASN.1 decoding flow may allow an attacker to remotely execute arbitrary code on the Security Management Server and Security Gateway.
All Security Management Server deployments are vulnerable, regardless of configuration, and require the fix described below.
Gateways that participate only in encryption communities where authentication is based on a Pre-Shared Key are not vulnerable.
Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway.
Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally.
Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies
Following additional research, we identified a rare scenario in which customers must install Check Point Live Patch Take 26, which provides enhanced coverage for this CVE.
CISA added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog on 2026-09-22 (CISA KEV, catalogue version 2026.09.22), and Check Point's own advisory confirms the reason: "Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally" (Check Point Research, 2026-09-22). "Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies" (Check Point Research, 2026-09-22), three days after the 2026-09-09 fix shipped. Check Point's own advisory sk1000117 carries a September 14 update explaining why some already-patched customers remained exposed during that wave: for customers who installed the Offline LivePatch Package while running R82.10 Jumbo Hotfix Take 24 or lower, R82 Jumbo Hotfix Take 107 or lower, or R81.20 Jumbo Hotfix Take 146 or lower, "following additional research, we identified a rare scenario in which customers must install Check Point Live Patch Take 26, which provides enhanced coverage for this CVE" (Check Point Support, sk1000117, updated 2026-09-14), a coverage gap in the original fix, closed by a second, hardened LivePatch issued five days after the initial patch and two days after exploitation attempts began. CVE-2026-85103, the companion heap-overflow certificate-decoding flaw, is unaffected by this gap and remains not confirmed exploited. Check Point's own hunting guidance: review logs for anomalous certificate-based Mobile Access logins without limiting the search to the observed certificate subjects, and treat follow-on internal port or service scanning from a logged-in Mobile Access session as second-stage activity warranting investigation.
Check Point's revision of sk1000118 on 2026-09-18 widens the population that needs CVE-2026-85103's fix. Its clarification reads: "All Security Management Server deployments are vulnerable, regardless of configuration, and require the fix described below". The flaw does not depend on any management configuration, and a management server is vulnerable even when VPN is neither used nor configured. The advisory now also lists the Spark Firewall among the affected products, and the R81.10 Jumbo Hotfix Accumulator from Take 190 carries the fix (Check Point, sk1000118, updated 2026-09-18). A Management Server that was left out of the patch round because it terminates no VPN is therefore in scope.
Both advisories now also give an interim mitigation for Remote Access VPN, which this entry had said did not exist: disable the Remote Access VPN implied rules and create explicit access rules for the services the clients need (UDP/500, UDP/4500, TCP/443 and, where used, TCP/80), limited to the clients' address ranges where possible (Check Point, sk1000117, updated 2026-09-24) (Check Point, sk1000118, updated 2026-09-18). It is for systems that cannot take the fix, carries the vendor's warning that a wrong rule set breaks connectivity, and does not apply to the locally managed Spark Firewall (Check Point, sk1000117, updated 2026-09-24) (Check Point, sk1000118, updated 2026-09-18). For CVE-2026-85102, sk1000117 now narrows the Site-to-Site exposure to gateways that use or allow certificate-based authentication. Gateways that participate only in communities authenticating with pre-shared keys are not vulnerable, while a community with dynamic-IP or Large Scale VPN gateways enables certificate authentication (Check Point, sk1000117, updated 2026-09-24).
A Management Server brought only to the minimum fix builds is not finished. Check Point lists Security Management at R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower and R81.10 Take 190 or lower as affected by CVE-2026-93616, a separate pre-authentication management flaw it has seen exploited (Check Point Research, 2026-09-22). The highest affected builds are the minimum fix builds listed above, so a server at exactly that level still needs the other flaw's own fix.
SAP's 8 September 2026 Security Patch Day fixed CVE-2026-44756 ("OVERPASS", CVSS 10.0) and CVE-2026-58240 ("S4GET", CVSS 9.8), both discovered and responsibly disclosed by Onapsis Research Labs, both remotely exploitable pre-authentication (CERT-EU, advisory 2026-011, 2026-09-09). OVERPASS is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport, a tracing structure attached to requests and parsed before session authentication; because the handling code is shared, the flaw is reachable via three independent unauthenticated routes: the Internet Communication Manager/Web Dispatcher (HTTP/HTTPS, Fiori/WebGUI/APIs), the SAP Dispatcher (the SAP GUI logon protocol), and RFC connections between systems, each with a single crafted request corrupting memory to reach arbitrary OS command execution as the account that owns the SAP installation (Onapsis, 2026-09-09; CERT-EU, 2026-09-09). Onapsis's own internet-wide fingerprinting found more than 10,000 unique internet-facing IPs presenting an SAP web interface, a figure it calls conservative since it structurally undercounts the SAP Web Dispatcher, which returns no distinguishing banner (Onapsis, 2026-09-09). S4GET is a distinct logic flaw in the SAP NetWeaver Message Server (kernel lines 9.16-9.20, native to S/4HANA and S/4HANA Cloud Private Edition) reachable through the same public port every SAP GUI client connects to: a crafted packet gets an arbitrary IP address accepted as a trusted internal node, and the Message Server propagates that false trust across the cluster so the Gateway admits the attacker as internal and the attacker can invoke RFC-callable programs to reach code execution as <sid>adm on every application server: "exploitation requires no credentials, no certificate, and no pre-existing misconfiguration" (Onapsis, 2026-09-09). Because the flaw abuses the Gateway's trust-membership decision rather than its ACLs, the standard secinfo/reginfo/ms/acl_info hardening does not intercept it. Neither flaw is confirmed exploited as of publication, but Onapsis notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, as happened with the RECON vulnerability (CVE-2020-6287), and that window keeps shrinking with AI-assisted tooling, while a comparable pre-auth SAP disclosure (CVE-2025-31324) became 2025's most-exploited CVE by Mandiant's count (Onapsis, 2026-09-09). Fixed via SAP Security Note 3747649 (OVERPASS, a single kernel patch closing all three routes, with an HTTP-only interim workaround in Note 3756304) and Note 3759472 (S4GET, kernel patch levels 9.16 PL100/9.18 PL32/9.19 PL17/9.20 PL7).
Triage: an SAP Gateway admitting a connection as internal from an IP address that is not a known application server, followed by invocations of RFC-callable programs from it, is the S4GET trust-abuse pattern Onapsis describes (Onapsis, 2026-09-09).
A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative.
Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as <sid>adm, the OS-level user that runs SAP, on every application server in the cluster.
On September 15th, a group of researchers publicly released an open-source SAP discovery and exploitation toolkit
Defenders should operate under the assumption that OVERPASS exploit PoCs have been made publicly available.
Onapsis Research Labs reports that on 2026-09-15 a group of researchers publicly released SAPMAP, an open-source (GPL 3.0) SAP discovery and exploitation toolkit that contains proof-of-concept exploits for both flaws, alongside ten standalone pre-authentication exploit files, post-authentication modules including an SAP ransomware proof of concept, and an automation loop that chains scanning, exploitation, enrichment and propagation (Onapsis, 2026-09-18). The maintainers first indicated that the OVERPASS exploits were being withheld, but Onapsis found them in the repository commits, says every clone since the original publication includes them and tells defenders to assume the OVERPASS proofs of concept are public (Onapsis, 2026-09-18). Onapsis had not observed threat actors using the toolkit when it wrote, and notes that public proof-of-concept releases can often jumpstart attack campaigns within days or weeks (Onapsis, 2026-09-18). Senthorus assesses on 2026-10-06 that packaging the capabilities together could reduce the preparation an intrusion needs, and separates that from evidence of use, which would need incident reporting (Senthorus, 2026-10-06). No source read reports exploitation of either flaw, and the fixes are unchanged: SAP Security Notes 3747649 and 3759472.
Google's Chrome 153 stable release (2026-09-08, versions 153.0.8010.36/.37 Windows/Mac, 153.0.8010.36 Linux) fixes 230 security bugs, including CVE-2026-87491, an out-of-bounds write in V8 that Google confirms is being exploited: "Google is aware that an exploit for CVE-2026-87491 exists in the wild" (Google, via Help Net Security, 2026-09-09). NVD describes the mechanism as allowing "a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page" (NVD, via The Hacker News, 2026-09-09), user interaction (visiting or being served the page) is required, but no authentication or special access. ENISA's EUVD records a CVSS 3.1 base score of 8.8 (ENISA EUVD, 2026-09-09); Google has disclosed no detail on the exploitation vector, victims, or actor, consistent with its practice of withholding detail until most users have updated. CERT-FR and NCSC-NL both independently issued advisories within a day of release ("Google reports that the vulnerability tracked as CVE-2026-87491 is being actively exploited," translated from Dutch, NCSC-NL, advisory NCSC-2026-0354, 2026-09-09), and CISA added the CVE to KEV the same day (CISA, 2026-09-09), with a due date of 2026-09-23 (CISA KEV catalog, 2026-09-09). This is the seventh Chrome zero-day Google has confirmed under active exploitation in 2026; every Chromium-derived browser (Edge, Brave, Opera, Vivaldi) inherits the same V8 engine and needs the equivalent update.
Google is aware that an exploit for CVE-2026-87491 exists in the wild.
Google (via Help Net Security)
Out-of-bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
NVD (via The Hacker News)
Google reports that the vulnerability tracked as CVE-2026-87491 is being actively exploited.
CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on 2026-09-09: a heap-based buffer overflow in the cw_acd CAPWAP daemon that FortiOS and FortiSwitchManager use to manage wireless access points, listening unauthenticated on UDP 5246 (CISA, 2026-09-09). SOCRadar's Threat Research Unit reports, with high confidence, that a likely Russian-speaking financially motivated operator has exploited the flaw since at least July 2026, targeting more than 30,000 FortiGate IP addresses and infecting 178 devices (SOCRadar, 2026-09-08). The exploit fingerprints a target's CAPWAP Discovery Response to leak memory pointers and defeat ASLR, matches the reported hardware/software revision against a hardcoded table of thirteen FortiGate and two FortiAP models on FortiOS 7.4.0-7.4.8, then grooms and overflows the daemon's heap-chunk pool via crafted CAPWAP messages to redirect execution (SOCRadar, 2026-09-08). Successful exploitation drops PivotC2, an AI-assisted Node.js RAT purpose-built for FortiGate post-exploitation that maintains a persistent multiplexed TLS channel, supports interactive shells and SOCKS5/HTTP tunneling, and (via an autonomous mode) harvests FortiGate configuration files and encrypted credential stores (VPN PSKs, SSL-VPN and LDAP bind credentials, admin accounts) using a device-specific key pulled from the device's own sync file (SOCRadar, 2026-09-08). In two confirmed US intrusions, operators pivoted further with reverse-SSH relays, network scanning, RDP-enablement registry edits for pass-the-hash, a PowerShell script that downloads and XOR-decrypts a payload before injecting it into svchost.exe via OpenProcess/VirtualAllocEx/WriteProcessMemory, and Exchange mailbox exfiltration to attacker-controlled cloud storage (SOCRadar, 2026-09-08). Affected: FortiOS 6.4 through 7.6.3, FortiSwitchManager 7.0-7.2.6, and FortiSASE 25.1.a.2/25.2.b; fixed in FortiOS 7.6.4/7.4.9/7.2.12/7.0.18 and FortiSwitchManager 7.2.7/7.0.6, with no confirmed fixed FortiSASE build in the sources reached this run.
Triage: an unexplained outbound TLS connection from a FortiGate management interface to a non-Fortinet destination, sustained over hours with periodic small keepalive-sized packets, is the multiplexed C2 channel's signature; normal FortiGate outbound traffic is FortiGuard update/telemetry to Fortinet's own infrastructure, not a persistent operator-controlled tunnel.
The SOCRadar Threat Research Unit (STRU) identified, with high confidence, exploitation of CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager cw_acd daemon.
Active exploitation has been observed since at least July 2026 and is still ongoing.
the actors highly likely leveraged AI to develop the RAT
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 2026-09-09, confirming active exploitation Cisco itself had not previously reported ("not aware of any public announcements or malicious use"). Status moves from patch-available-only to confirmed exploited; the hot fixes and compromise check this entry already describes are unchanged, but the compromise check is now the do-now priority rather than a precaution.
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 2026-09-09, with a remediation due date of 2026-09-12 for federal civilian agencies. This confirms active exploitation that Cisco's own advisory had not reported as of its last revision, and reverses the no-known-malicious-use framing this entry's main analysis carried. The compromise check and hot-fix guidance above are unchanged; any FMC that has been network-reachable since 2026-03-04 and has not yet had the compromise check run should be treated as a priority, not a precaution.
The 2026-09-08 update stated CVE-2026-19490 had not been added to CISA's KEV catalog; CISA added it on 2026-09-09 (due date 2026-09-12). This is a listing/bookkeeping addition (the CVE was already recorded as exploited before this listing) so no exploitation-status narrative changes; the stale sentence is corrected in place. Also added the missing FIRST.org EPSS citation for CVE-2026-19490 (score unchanged, 0.0337, verified against FIRST.org); the entry's only prior EPSS source was scoped to CVE-2026-19489.
CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog on 2026-09-09, with a remediation due date of 2026-09-12 for federal civilian agencies. This CVE was already recorded here as exploited before this listing, so the addition is a jurisdiction-agnostic confirmation of what this entry already stated rather than a new exploitation-status development.
LevelBlue SpiderLabs independently reproduced and analysed all four PoCs, supplying mechanism-level detail the original vendor statements lacked: HardBreacher's session-namespace symlink DLL-load-path hijack with parent-PID spoofing, PrettyPrague's aswSnx IOCTL abuse to dump and offline-decrypt the SAM database via a CMSTPLUA UAC bypass, and a reparse-point/oplock mechanism for FalconFlank, which LevelBlue's own lab testing found CrowdStrike's cloud ML detection caught and quarantined, preventing the final step in that test run. LevelBlue also independently characterises GreenSection as a shared-memory-section trust-boundary finding with no demonstrated privilege escalation, a narrower claim than the original report's "memory-corruption bug" framing. Credibility moves from 2 to 1 on this independent confirmation. LevelBlue's own Key Takeaways further state that both FalconFlank and PrettyPrague have since received vendor remediation, though it names no specific patch version or date for either, superseding this entry's original "no fix"/"still developing a patch" framing for both, which the title, headline, summary, tags, actions and body are corrected to reflect.
LevelBlue SpiderLabs independently reproduced and analysed all four PoCs, adding mechanism-level detail none of the original vendor statements carried. HardBreacher: "every Windows logon session has a private object directory inside the kernel's namespace – \Sessions\0\DosDevices\{AuthId}\, and any standard user process can place symbolic links inside their own session's directory without any special privilege" (LevelBlue SpiderLabs, 2026-09-09); the exploit builds a fake filesystem tree redirecting Kaspersky's avpuimain.dll load path to an attacker DLL, then spawns avpui.exe suspended with the redirect live and resumes it so the OS loader loads the malicious DLL, additionally using NtCreateUserProcess with the parent-process attribute set to explorer.exe so EDR process-tree telemetry records Explorer, not the real caller, as the parent, the payload then hides and terminates the product's user-facing notification process from inside. PrettyPrague: "the vulnerability is that a standard user process can send IOCTL 0x82AC0054 directly to the aswSnx driver to request that a chosen executable be run inside the sandbox" (LevelBlue SpiderLabs, 2026-09-09), where the sandbox's virtualized SAM-hive copy carries none of the real SAM's ACLs; the exploit races the sandbox's own cleanup to copy the hive out via a rolled-back Kernel Transaction Manager transaction, decrypts NTLM hashes offline using the LSA boot key, and reaches a SYSTEM context through a CMSTPLUA COM-interface UAC bypass to log in as every local admin, reverting the passwords afterward. FalconFlank's precondition is narrower than the original report suggested: "for CrowdStrike clients to be susceptible to this local privilege escalation vulnerability, an endpoint must be assigned to a Prevention Policy with the 'Microsoft Office file malicious macro removal' setting enabled. This vulnerability does not impact CrowdStrike Falcon Government clients" (LevelBlue SpiderLabs, 2026-09-09), and in LevelBlue's own lab testing, CrowdStrike's cloud-based ML engine (detection logic OnWriteOfficeMacroMLMedium) identified and quarantined the malicious DLL the exploit stages, preventing the final privilege-escalation step in that test run, a detection outcome that limits, without eliminating, the real-world exploitability the initial disclosure implied. LevelBlue independently characterises GreenSection differently from the original report's "memory-corruption bug that crashes any application using Vulkan or OpenGL": its own analysis describes a standard user opening, mapping, modifying and restoring an NVIDIA global shared-memory section, with no privilege-escalation or code-execution primitive demonstrated, a narrower, trust-boundary-design finding rather than a crash bug, though LevelBlue did not claim to have tested for a crash condition either.
LevelBlue's closing assessment also updates the patch picture this entry originally carried: "PrettyPrague demonstrated the most significant security impact prior to remediation, while HardBreacher highlighted opportunities for security-product abuse and evasion. GreenSection is primarily a security design concern, and FalconFlank's operational relevance was limited both by its configuration-dependent exposure and by rapid vendor remediation" (LevelBlue SpiderLabs, 2026-09-09); both FalconFlank and PrettyPrague are now reported remediated, which supersedes the "no fix"/"still developing a patch" status this entry carried at disclosure. The Hacker News's own update to its original report names a specific fix: "as of September 4, 2026, Gen has released a patch for the following versions of Avast Antivirus for Windows - 26.7.11086, fix version 992 [and] 26.8.11125, fix version 993" (The Hacker News, 2026-09-03). No source reached for this entry names a specific fixed CrowdStrike Falcon build or date for FalconFlank; confirm current release status directly with CrowdStrike rather than treating this as a version-checkable patch.
The leak's national-security framing sharpens: a CDU defense-policy spokesperson states the published dataset includes civil-defense/total-defense emergency plans and barracks documents alongside the critical-infrastructure material already recorded, prompting the Bundeswehr's own operational command to join BSI's review. Separately, the Berlin district of Lichtenberg has refused to deploy CrowdStrike's Falcon Agent on its own servers over data-access and monitoring concerns, and Berlin's data protection commissioner has issued concrete victim guidance.
CDU defense-policy spokesperson Roderich Kiesewetter told Süddeutsche Zeitung "this data leak is of grave scope and endangers our national security" (translated from German), naming civil-defense and total-defense emergency plans and barracks documents as part of the published dataset alongside the critical-infrastructure material already recorded here; Germany's Bundeswehr Operative Führungskommando and the Nationales Cyberabwehrzentrum have joined BSI in reviewing the security fallout (heise online, citing Süddeutsche Zeitung, 2026-09-07). Separately, the Berlin district of Lichtenberg has refused to deploy CrowdStrike's Falcon Agent on its own servers: "in an internal letter, he cites concerns, according to rbb, about near-unlimited data access, possible disruption to specialised administrative applications, and remaining monitoring risks for staff" (translated from German), while the district states it has found no evidence of intrusion on its own systems and is demanding the Senate assume full responsibility and cost for the response (heise online, citing rbb24, 2026-09-07). Berlin's data protection commissioner Meike Kamp has now issued concrete guidance for potentially affected individuals: "change passwords, closely monitor account activity, and increased scepticism toward phishing emails" (translated from German) (heise online, citing Meike Kamp, 2026-09-07).
GreyNoise documents an AI-agent-orchestrated mass-exploitation campaign against this chain beginning 31 August 2026, using hundreds of AI agents to opportunistically compromise 440 PaperCut instances across 395 organizations in 48 countries, reaching domain admin against 12 of them in as little as five minutes via LSASS credential harvesting, the 2021 noPac flaws, or a PaperCut host running on the domain controller itself, all finishing with a DCSync-based NTDS.DIT credential dump.
GreyNoise's Global Observation Grid documents an AI-agent-orchestrated exploitation campaign against this chain
beginning 31 August 2026, run by a likely Russian-speaking operator already tracked since July 2026 for attacks on
Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE targets
(GreyNoise, 2026-09-09). The
operator built and tested both CVEs' exploits in a self-hosted PaperCut/Active Directory lab, sourced target lists
via the Netlas.io scanning service, then deployed hundreds of AI agents, built on OpenAI's Codex harness paired
with a DeepSeek model, to opportunistically "compromise at least 440 instances of PaperCut MF/NG hosted by 395
identified victim organizations in 48 countries"
(GreyNoise, 2026-09-09). GreyNoise
reports the adversary "went from an empty workspace to first achieving RCE against a real victim in just under
four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at
least 11 organizations in 26 seconds"
(GreyNoise, 2026-09-09), with one
US high school reaching full domain admin in seven minutes from initial access. Domain admin was ultimately reached
against only twelve of the 395 compromised organizations, "GreyNoise observed the adversary achieved domain admin
against only 12 victim organizations"
(GreyNoise, 2026-09-09), via three
paths: LSASS credential harvesting for pass-the-hash against the domain controller when the PaperCut host was
domain-joined; the 2021 noPac flaws (CVE-2021-42278/CVE-2021-42287) where those remained unpatched; or directly
adding a new account to Domain Admins when the PaperCut host itself ran on the domain controller or under a
domain-admin service account. All three paths finished with a DCSync-based full NTDS.DIT credential dump; Cloudflare's
WAF defeated the adversary against at least one targeted instance. This delta is reported by GreyNoise alone; a
second independent source had not corroborated it as of this update.
Confirm every CrowdStrike Falcon sensor and Gen Digital Avast install (including on unmanaged or contractor endpoints) is on the current release now that both vendors are reported to have remediated FalconFlank and PrettyPrague; until that is confirmed, treat any endpoint on an older build as still exposed and keep the "Microsoft Office File Suspicious Macro Removal Windows" Falcon prevention setting disabled as an interim control on unconfirmed hosts.
Apply LivePatch Take 24 or the appropriate Jumbo Hotfix Accumulator to every Check Point Security Gateway, Security Management Server and Spark Firewall now, including management servers with no VPN configured, which Check Point states are vulnerable regardless of configuration; if the offline LivePatch package was used on R82.10 JHF Take 24 or lower / R82 JHF Take 107 or lower / R81.20 JHF Take 146 or lower, also install the hardened Take 26; the locally managed Spark Firewall has no workaround short of patching.
Review Mobile Access logs for anomalous certificate-based logins and any follow-on internal port/service scanning from suspicious Mobile Access sessions on every Spark Firewall, whether or not it has already been patched.
After confirming Chrome ≥152.0.7977.82 and the September Windows cumulative update are deployed fleet-wide, separately audit installed Chromium extensions requesting broad host/tab/storage permissions and any browser-associated scheduled task created in the days before patching; neither the malicious GemStone extension nor the kit's scheduled-task persistence is removed by the OS/browser patch.
Apply SAP Security Notes 3747649 (OVERPASS) and 3759472 (S4GET) to every SAP kernel-based system now, internet-exposed systems first and then internal ones, because the affected components are commonly reachable through internal firewalls; public proof-of-concept exploits for both flaws have been available since 2026-09-15 in the SAPMAP toolkit, and Onapsis found over 10,000 internet-facing SAP interfaces.
Update Chrome, Edge and every other Chromium-based browser in the fleet to ≥153.0.8010.36 now; this is the seventh actively-exploited Chrome zero-day patched in 2026, and Google has disclosed no interim mitigation short of the update.
Patch every internet-facing FortiGate/FortiSwitchManager to the fixed builds now, and on any device that exposed CAPWAP (UDP 5246) to an untrusted network before patching, rotate VPN PSKs, SSL-VPN and LDAP bind credentials and admin passwords rather than relying on the patch alone; PivotC2's autonomous mode is built to harvest exactly those credential stores.
Upgrade every PaperCut NG/MF Application Server, Site Server and secondary/print server to the security maintenance release for its line (26.0.5, 25.0.13 or 24.1.10), starting with any still on Emergency Patch Release 1 or 2, and note that the emergency builds do not carry the fix for CVE-2026-82077, an administrator-only Scan-to-Fax code-execution flaw that the vendor's September bulletin lists as fixed in 26.0.5 and 25.0.13 and does not list for 24.1.10; for v23 and earlier, immediately restrict the Application Server's web interface to trusted/internal IP addresses only; no patch exists for that line.
Before patching or restarting an internet-facing server, preserve the server/logs directory and process tree; check server.log for the two vendor-documented error strings and for an unexplained gap or truncation, check derby.log for a Derby boot line naming an in-memory database directory ending in "pwn", and hunt for a Windows service named "Remote Access Service" running SimpleService.exe (SimpleHelp) or an unexpected AnyDesk install, as PaperCut's own published incident data names both as an observed post-compromise access method.
Given GreyNoise's confirmed domain-admin escalation paths, verify no PaperCut Application Server is domain-joined with a privileged service account or hosted on a domain controller, and confirm domain controllers reachable from any PaperCut host are patched against the 2021 noPac flaws (CVE-2021-42278/CVE-2021-42287); GreyNoise reports the AI-orchestrated campaign reaching full domain admin through these paths in as little as five minutes after initial access.
2026-09-10T0410Z-intel· Sonnet 5 · window 24 h · 5 entries published
Verification & coverage notes
Intraday fire (gap_hours 10.72, window_hours 24 floor). Mechanical KEV sweep (tools/kev_window_diff.py) flagged 2 not-yet-covered CISA KEV additions in-window (CVE-2025-25249 Fortinet, CVE-2026-87491 Chrome); both fully researched and published as new entries. 5 new entries, 3 changelog updates.
borderline-drop: Veradigm (formerly Allscripts) vendor-API credential breach, US-domiciled healthcare-technology vendor, disputed scale (victim's own SEC 8-K says "a small number of customers" against the actor's claimed 3.5M records); the actor (actor:thegentlemen) carries an established European leak-site pattern and an uncorroborated current Swiss claim (Ixa Systems SA, tracked in coverage_backlog.md), but neither that actor-nexus argument nor the vendor-API-scoping lesson (standard practice, not a novel TTP) clears the stricter out-of-nexus breach gate on their own. Relevance-doubt resolves toward drop (v4.2).
borderline-drop: Mantax Otax, Indonesian consumer Android ransomware/spyware hybrid (Zimperium zLabs, single-source). No Swiss/EU/public-sector nexus; the constituency's device fleets are MDM-managed, making a sideload-only consumer-Android technique class a poor transferability fit. Does not clear PD-11(d).
Coverage backlog (state/coverage_backlog.md) worked this run: Boston Scientific struck (operationally concluded, "fully restored," no mechanism ever disclosed across 10 checks over two weeks); Zurich verdict, inside-it.ch Insel Gruppe, Ixa Systems SA, UICC (Krybit), Kairos/Ville de Libercourt, VMware VMSA-2026-0007, and the Spring Ring NTLM-relay row all re-checked with no change; dated notes appended to each. Three new backlog rows opened: Medela AG (ShinyHunters claim, Swiss home-region, uncorroborated), reichenau.at (SafePay claim, Austrian municipality, uncorroborated), and Ville du Tampon (France, victim-confirmed incident, no mechanism disclosed).
Dedup: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain shares CVE-2026-85046 with 2026-09-04/cve-2026-85046-chrome-v8-type-confusion-exploited and CVE-2026-85880 with 2026-09-09/windows-september-2026-two-exploited-lpe-zero-days-kev, both declared in references[] as a genuinely distinct finding (a named exploit kit + four actor clusters) building on the covered CVEs, not a duplicate.
Watchlist: no watchlists configured (documented no-op on all four domains).
Essential-coverage: cisa-advisories 403'd for a 2nd consecutive run (transport block, never demotes; tools/fetch_source.py bridge already in use).
Coverage gaps: ccb-belgium (fetched, advisory list not confirmed present/absent); reliaquest, group-ib, ibm-xforce (all reached, newest content outside the 24h window); ransom-isac, venarix, zaufana-trzecia-strona, cyberinsider (all reached, no in-window content).