Important Developments 

Microsoft fixes two exploited Windows zero-days

Microsoft’s 8 September update addressed exploited CVE-2026-85880 and CVE-2026-81963, both allowing local privilege escalation to system. The unusually large release also contains multiple remotely exploitable flaws.

• Why you should care: Enterprise Windows estates face immediate post-compromise escalation risk.
• Impact: Accelerated testing may pressure change windows and service availability; regulated entities should document risk-based deployment decisions.
• Recommended actions: Prioritize the two zero-days, harden local execution paths and monitor failed or unusual update activity.

Sources
https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep
https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/

NetScaler authentication bypass enters active exploitation

CISA added CVE-2026-19490, a CVSS 9.3 NetScaler ADC and Gateway authentication bypass, to KEV after exploitation began. Gateway, VPN and AAA deployments are affected.

• Why you should care: NetScaler commonly protects remote access and published applications in large European organizations.
• Impact: Compromise can expose sessions and internal services, causing access outages and potential NIS2 or GDPR assessment.
• Recommended actions: Patch on an emergency basis, restrict management exposure, terminate sessions and inspect appliances for persistence.

Sources
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.securityweek.com/critical-netscaler-vulnerability-exploited-in-attacks/

Cisco firewall management flaw exploited by state and ransomware actors

Cisco confirmed active exploitation of CVE-2026-20079 in Secure Firewall Management Center. Cisco Talos linked activity clusters to state-sponsored actors and Qilin ransomware.

• Why you should care: A compromised management plane can provide root access, credentials and control over security policy.
• Impact: Firewalls may require isolation or rebuild, affecting connectivity and evidence preservation.
• Recommended actions: Patch immediately, remove internet exposure, use Cisco indicators and rotate credentials held by the manager.

Sources
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-authbypass
https://www.securityweek.com/organizations-warned-of-cisco-secure-fmc-exploitation/

WatchGuard exploitation now linked to ransomware

CISA confirmed that ransomware operators exploit critical Firebox vulnerability CVE-2025-14733. The issue affects exposed IKEv2 VPN configurations and has been in KEV since 2025.

• Why you should care: The renewed ransomware link changes a patch backlog item into an incident-hunting priority.
• Impact: Edge compromise can interrupt remote access and enable lateral movement into business services.
• Recommended actions: Confirm fixed versions, hunt with vendor indicators, rotate locally stored secrets and retire unsupported appliances.

Sources
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.bleepingcomputer.com/news/security/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks/

Critical Check Point VPN flaws require emergency remediation

Check Point released fixes for CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8 and capable of unauthenticated remote code execution under specific conditions. No exploitation is confirmed.

• Why you should care: VPN gateways are high-value perimeter systems and historically attract rapid weaponization.
• Impact: Successful exploitation could expose security management, remote access and internal networks across sectors.
• Recommended actions: Verify LivePatch status or install Jumbo Hotfixes; restrict VPN peers and UDP 500/4500 where feasible.

Sources
https://support.checkpoint.com/results/sk/sk1000117
https://support.checkpoint.com/results/sk/sk1000118
https://advisories.ncsc.nl/

Chrome patches seventh zero-day of 2026

Google released Chrome 153 fixes including an actively exploited zero-day, prompting NCSC-NL to publish a high-impact advisory.

• Why you should care: Browsers bridge user identity, cloud applications and local endpoints, making exploitation broadly relevant.
• Impact: A successful attack may expose sessions or enable endpoint compromise; delayed browser rollout increases fleet-wide exposure.
• Recommended actions: Force browser relaunch and update, verify managed-device compliance and monitor anomalous session reuse.

Sources
https://advisories.ncsc.nl/
https://chromereleases.googleblog.com/
https://www.securityweek.com/chrome-153-patches-seventh-zero-day-of-2026

Surfshark discloses exposed internal test infrastructure

Surfshark said attackers accessed an internet-exposed internal testing server and proxy infrastructure following a configuration error.

• Why you should care: Security and privacy providers hold elevated trust; test environments can still contain credentials and production pathways.
• Impact: Customer confidence, supplier assurance and credential exposure are the primary business concerns.

Sources
https://surfshark.com/blog/security-incident
https://www.bleepingcomputer.com/news/security/surfshark-vpn-says-hackers-breached-internal-testing-proxy-servers/

ENISA consultation on managed security certification nears close

ENISA’s consultation on the EU cybersecurity certification scheme for managed security services closes 13 September. The draft initially focuses on incident-response services. You can still share your ideas (EU Login or eID required.)

• Why you should care: The scheme may shape assurance expectations for outsourced detection and response across Europe.
• Impact: Procurement, audit evidence, continuity and supplier selection may need alignment with future certification requirements.

Sources
https://certification.enisa.europa.eu/news/have-your-say-certification-eu-managed-security-services-2026-07-24_en

Takeaways

Common Patterns

Identity-adjacent infrastructure remains the dominant route to material impact: VPN gateways, firewall managers, browsers and supplier applications. Attackers are exploiting trusted control points, then using legitimate sessions or management privileges. Ransomware remains closely tied to older exposed-edge weaknesses.

Sector Insights

Government, education and distributed enterprises face elevated exposure through print and remote-access systems. Technology and security-service providers should treat test environments and management planes as production-grade assets.

Regulatory Implications

Dutch entities under the Cyberbeveiligingswet should rapidly classify incidents involving essential services and preserve evidence for reporting. DORA-regulated firms should connect edge compromise and supplier incidents to third-party registers, continuity testing and exit plans. ENISA’s managed-security certification work may raise future assurance expectations.

Strategic Recommendations

CISOs should create a same-day path for KEV and perimeter remediation. Security leaders should hunt after patching, not assume patching removes persistence. Risk leaders should map suppliers to critical services and recovery dependencies. Privacy officers should separate confirmed facts from extortion claims and prepare coordinated notification language.

Board-level Narrative

The board-level issue is concentration of operational risk in a small number of trusted access systems and suppliers. CISOs should report whether exposed gateways are patched and clean, whether critical services can continue if remote access or a supplier is isolated, and whether regulatory decisions can be made from preserved evidence. Governance should track time-to-remediate exploited flaws, recovery readiness and supplier access, rather than patch volume alone.

This overview was generated with AI assistance and has been verified and edited by a human editor. If you have spotted a factual error, please let us know in the comments.

The information contained in this security watch is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. CISO Community and CISO Platform Nederland assume no legal liability or responsibility for any damage resulting from either the use or inability to use the information included. This includes damage resulting from the inaccuracy or incompleteness of the information contained in the briefing.