Vulnerability Overview
Exploitation Activity
Exploitation Intelligence
In September 2026, several critical vulnerabilities were disclosed, notably CVE-2026-81963 and CVE-2026-85880, both of which are actively exploited. CVE-2026-81963, affecting Windows Update Stack, allows local privilege escalation without user interaction. CVE-2026-85880, a heap-based buffer overflo...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in Microsoft Windows, Adobe, N-able, Cisco, Google Chromium, Fortinet, and Citrix. Notably, CVE-2026-75650, a critical Ado...
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular pl...
On September 8, 2026, Microsoft released a record-breaking 974 patches for vulnerabilities across its products, including two actively exploited zero-day vulnerabilities: CVE-2026-81963 and CVE-2026-85880. These vulnerabilities allow local attackers to escalate privileges to SYSTEM level, posing sig...