Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
CERT-SE · Advisory ·
Patchtisdag september 2026 – samlad information om månadens säkerhetsuppdateringar
Microsoft released security updates for 973 vulnerabilities.
Microsofts säkerhetsuppdateringar omfattar 973 sårbarheter varav 113 klassade som kritiska. Flera leverantörer har släppt sina månatliga säkerhetsuppdateringar för september. CERT-SE rekommenderar att installera säkerhetsuppdateringarna.
Recommended by the publisher: CERT-SE recommends installing security updates as soon as possible.
CVE-2026-17038 affects drEryk Gabinet before 11.5.0. The vulnerability uses hard-coded API credentials. An attacker can perform privileged operations. CERT Polska received the report.
Recommended by the publisher: Update to version 11.5.0 or later.
2026-012: Critical Vulnerabilities in Check Point Products
Check Point products have critical vulnerabilities.
Check Point Security Gateway, Security Management Server, and Spark Firewall are affected. Vulnerabilities CVE-2026-85102 and CVE-2026-85103 allow an unauthenticated, remote attacker to execute arbitrary code. They affect deployments using Site-to-Site VPN or Remote Access VPN.
Recommended by the publisher: CERT-EU strongly recommends applying the available hotfixes as soon as possible.
Version 1.0: SAP - Kritische Schwachstellen bedrohen verschiedene Anwendungen
SAP products have critical vulnerabilities.
SAP has disclosed 19 vulnerabilities, including CVE-2026-44756 in the SAP Extended Passport Processing library. An attacker could execute OS commands with administrative rights. The vulnerability affects several SAP components and can be exploited without authentication.
Recommended by the publisher: The BSI recommends reviewing the SAP Patchday information.
2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
SAP Kernel and NetWeaver are vulnerable to critical exploits.
CVE-2026-44756 and CVE-2026-58240 affect SAP products, allowing remote exploitation without authentication, and can result in arbitrary operating system command execution. Onapsis assesses that successful exploitation allows a remote attacker to execute arbitrary operating system commands on the SAP host with SAP administrative privileges. The vulnerabilities are remotely exploitable.
Recommended by the publisher: CERT-EU strongly recommends applying SAP Security Notes 3747649 and 3759472 as soon as possible.
Microsoft has released its monthly security updates. NSM has no specific vulnerabilities to highlight. The updates are available on Microsoft's website.
Recommended by the publisher: NSM recommends system owners to update their software to the latest version as soon as possible.
CERT Polska found vulnerabilities in Mikrotik RouterOS software. Vulnerable versions include 7.24 below 7.24.2 and 7.9 below 7.23.4. An attacker can forge signatures or gain unauthorized access.
Recommended by the publisher: Update to version 6.49.21, 7.23.4 or 7.24.2.
Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended
MikroTik RouterOS vulnerabilities are being exploited.
CERT Polska identified six vulnerabilities in MikroTik RouterOS, including CVE-2026-67276 and CVE-2026-86060. MikroTik has released fixes in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Attacks are exploiting these vulnerabilities to take control of devices.
Recommended by the publisher: Update RouterOS immediately to a version containing the complete fixes and check the configuration for unknown users and changes.
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
China-based AI companies conduct industrial-scale distillation campaigns against U.S. AI companies.
China-based AI companies, including DeepSeek and Alibaba, extracted billions of tokens from U.S. frontier AI models, violating terms of use. They use multiple pathways and proxies to gain unauthorized access. CISA assesses these activities threaten U.S. technological leadership.
Recommended by the publisher: CISA recommends U.S. AI companies implement detection and mitigation, deploy targeted response changes, and establish cross-organization intelligence sharing.
Version 1.0: Deutsche Institutionen über TerminalFix-Kampagne kompromittiert
German institutions compromised via TerminalFix campaign.
The BSI was informed of a network compromise at a state institution in August 2026. The attack is consistent with Microsoft's reported TerminalFix campaign. The attackers attempted to install Ransomware and extort victims.
Recommended by the publisher: The BSI recommends checking the BSI-IT-Sicherheitsmitteilung for further information.
Vulnerability in OptimiDoc Server (On-Premise) software
OptimiDoc Server On-Premise has a password storage vulnerability.
CVE-2026-15933 affects OptimiDoc Server versions before 26.08. An authenticated administrator can view credentials in cleartext. This issue was fixed in version 26.08.
Recommended by the publisher: CERT Polska recommends updating to version 26.08.
Version 1.0: SonicWall SMA1000 - Schwachstellen werden aktiv ausgenutzt
SonicWall SMA1000 vulnerabilities are being actively exploited.
SonicWall has published an advisory for two vulnerabilities in its SMA1000 product series, CVE-2026-83548 and CVE-2026-83549. SonicWall has stated that these vulnerabilities are being exploited. Attackers can use the vulnerabilities to bypass authentication mechanisms and execute code remotely on vulnerable systems.
Recommended by the publisher: The BSI recommends checking the IT-Sicherheitshinweis for further information.
Dool software has vulnerabilities, concerns users of versions up to 1.3.8.
CVE-2026-56651 and CVE-2026-56652 affect dool versions up to 1.3.8. A local attacker can exploit these vulnerabilities to overwrite sensitive files or inject malicious formulas into CSV output. CERT Polska has received a report about these vulnerabilities. The issues were addressed by pull requests #116 and #117.
Recommended by the publisher: CERT Polska recommends updating dool to a version where these issues are fixed.
Disruptive cyber activity highlights risk from internet-exposed systems and edge devices
NCSC warns of increased targeting of operational technology systems.
The NCSC has seen increased targeting of operational technology systems across multiple sectors globally. Any organisation with internet-exposed OT could be affected. The NCSC assesses that the threat from state use of offensive cyber has almost certainly increased.
Recommended by the publisher: The NCSC recommends organisations build a definitive view of their OT architecture and harden their OT boundary.
GNU wget versions through 1.25.0 are vulnerable to denial of service in FTP OPIE/S-KEY authentication. A malicious FTP server can cause wget to perform excessive MD5 computations. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa.
Recommended by the publisher: Update wget to a version after 1.25.0.
KAON PG5298A and PG5298B routers have Incorrect Authorization and Missing Authentication vulnerabilities. Firmware in these routers allows users to perform unauthorized operations. These vulnerabilities have been fixed in firmware versions 3.0.82 and 4.0.82.
Recommended by the publisher: Update to firmware version 3.0.82 for PG5298A and 4.0.82 for PG5298B.
A Tale of Two SOCs: Insights From Two Red Team Assessments
CISA conducted red team assessments at two organizations.
The red team achieved full domain compromise and accessed sensitive business systems and cloud resources. Organization A failed to detect the activity, but Organization B identified and contained it. CISA assesses that untuned detection tools and organizational silos hindered effective incident response.
Recommended by the publisher: CISA recommends implementing Conditional Access policies and establishing procedures for detecting cloud compromises.
Citrix NetScaler ADC and NetScaler Gateway have vulnerabilities CVE-2026-19490 and CVE-2026-19489. NSM expects exploitation. CVE-2026-19490 allows bypassing authentication. CVE-2026-19489 is a buffer overflow vulnerability.
Recommended by the publisher: NSM recommends updating vulnerable devices as soon as possible.
Kritisk sårbarhet i Citrix NetScaler ADC och NetScaler Gateway
Citrix NetScaler ADC and Gateway have a critical vulnerability.
Citrix NetScaler ADC and NetScaler Gateway are affected by CVE-2026-19490, which has a CVSS score of 9.3. An unauthenticated attacker can remotely execute arbitrary code. CISA has added CVE-2026-19490 to the KEV catalog. Affected products include NetScaler ADC and Gateway versions 14.1 prior to 14.1-73.32 and 13.1 prior to 13.1-63.21.
Recommended by the publisher: CERT-SE recommends updating systems and checking for signs of intrusion.
ATutor 2.2.4 is vulnerable to remote code execution, authentication bypass, and cross-site request forgery. An attacker can upload malicious scripts, authenticate as an existing user, or modify profile fields. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: CERT Polska recommends updating ATutor software.