Attackers are chaining two unpatched AhsayCBS flaws to run code as SYSTEM and plant webshells and XMRig miners, according to Huntress. Managed service providers are the main users of the console, so the hosts being hit are the ones that manage backup users and policies for clients.
Perspective Coverage
6 publishers
- Builder
- Builder 22%
- Operator
- Operator 71%
- Investor
- Investor 7%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+8
- Incentives30
- Confidence76
A crafted email is already getting root on unpatched Cisco Secure Email Gateways
CVE-2026-76461 is under active exploitation, hits every physical and virtual Secure Email Gateway whatever its configuration, and has no workaround. CISA gave federal civilian agencies until September 17 to install the fixed builds.
Reality
- Evidence72
- Adoption55
- Hype gap0
- Incentives60
- Confidence68
Attackers seized MSP N-central servers through the bypass N-able's incomplete fix left open
N-able's fix for one N-central authentication bypass produced another that was already being exploited, and the hotfix for that was replaced four days later. Three N-central CVEs now sit in CISA's exploited catalog.
Publishers:rapid7.com
Reality
- Evidence64
- Adoption58
- Hype gap−8
- Incentives58
- Confidence62
August's 398-CVE Patch Tuesday moves the bottleneck to the test bench
Only one of the 398 CVEs Microsoft fixed in August was confirmed exploited, and the SharePoint chain now hitting servers turns on a July patch, which puts exposure on cycle lag rather than on ranking.
Reality
- Evidence33
- Adoption44
- Hype gap+16
- Incentives56
- Confidence38
Microsoft patched an exploited Entra ID RCE on its own side of the tenant boundary
CVE-2026-69836 scored 10.0 and allowed unauthenticated remote code execution against Microsoft's identity service, and because the fix landed server-side, no customer ever had a version to check or a window to schedule.
Reality
- Evidence28
- Adoption15
- Hype gap−35
- Incentives
- Not scored
- Confidence30