Weekly briefing

Week 38 · 14 Sep – 20 Sep 2026 UTC · assess the changes, then plan the next dates.

All dated changes in this period

109 source records · 26 groups

18 Sep 2026

SecurityMicrosoft Edge2 source records

Published vulnerability · 2 entries

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-88097
Assessment context
Microsoft states that customer action is required
Edge 153.0.4234.48: Chromium security fixes
Security advisory · Microsoft Edge security release notes

18 Sep 2026

Message CenterDefender

MC1474106: Microsoft Defender for Office 365: New MessageContents table in Advanced Hunting for Microsoft Teams messages

Message Center · Stay informed

Microsoft Defender XDR

18 Sep 2026

SecurityCisco7 source records

Security news · 7 entries

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Logging Denial of Service Vulnerability
Security news · Cisco security advisories

Show the other 4 entries

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Object Group Access Control List Bypass Vulnerabilities
Security news · Cisco security advisories
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Secure Firewall 3100 and 4200 Series DTLS Denial of Service Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026
Security news · Cisco security advisories

17 Sep 2026

SecurityAzure / Azure Arc2 source records

Published vulnerability · 2 entries

Azure Arc Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-69399
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure Arc Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-70009
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

17 Sep 2026

SecurityAzure10 source records

Published vulnerability · 10 entries

Azure AI Foundry Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-85889
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure AI Foundry Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-85917
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure Billing Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-62874
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

Show the other 7 entries

Azure Cosmos DB Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-87701
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure Database for PostgreSQL Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-85878
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure Logic Apps Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-70200
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure Logic Apps Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-83944
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure Machine Learning Information Disclosure Vulnerability
Published vulnerability
CVE-2026-68791
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Azure Portal Spoofing Vulnerability
Published vulnerability
CVE-2026-83946
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Microsoft Container Registry Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-69865
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

17 Sep 2026

SecurityMicrosoft 365 Apps / Microsoft Fabric

Microsoft Fabric Elevation of Privilege Vulnerability

Published vulnerability

CVE-2026-69843

Assessment context

Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

17 Sep 2026

SecurityMicrosoft 365 Copilot Business Chat Information Disclosure Vulnerability

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

Published vulnerability

CVE-2026-78501

Assessment context

Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

17 Sep 2026

SecurityMicrosoft 365 Copilot2 source records

Published vulnerability · 2 entries

M365 Copilot Information Disclosure Vulnerability
Published vulnerability
CVE-2026-85887
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-85885
Assessment context
Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

17 Sep 2026

SecurityMicrosoft Copilot Information Disclosure Vulnerability

Microsoft Copilot Information Disclosure Vulnerability

Published vulnerability

CVE-2026-55946

Assessment context

Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

17 Sep 2026

SecurityPower Platform

Microsoft Dataverse Elevation of Privilege Vulnerability

Published vulnerability

CVE-2026-77903

Assessment context

Fixed by Microsoft in the service; nothing to deploy · Microsoft rates the vulnerability Critical

17 Sep 2026

SecurityCisco2 source records

Security news · 2 entries

Cisco IOS XR Software Security Hardening Release: September 2026
Security news · Cisco security advisories
Cisco Secure Email Gateway SQL Injection Vulnerability
Security news · Cisco security advisories

17 Sep 2026

SecurityDefender

Improving email security outcomes with real-world Microsoft Defender insights

Security news · Microsoft Security Blog

17 Sep 2026

SecurityMicrosoft Edge

Edge 153.0.4234.46: Chromium security fixes

Security advisory · Microsoft Edge security release notes

17 Sep 2026

SecurityMicrosoft Security Blog

From guidance to action: Security fundamentals that materially reduce risk

Security news · Microsoft Security Blog

16 Sep 2026

SecurityAndroid

Google Pixel Improper Authorization Vulnerability

Google · exploited, added to CISA KEV

CVE-2026-58704

Assessment context

CISA lists it as exploited

16 Sep 2026

SecurityCisco23 source records

Cisco · exploited, added to CISA KEV · 23 entries

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco · exploited, added to CISA KEV
CVE-2026-76460
Assessment context
CISA lists it as exploited
Cisco Advance Notification for Publication of September 16, 2026, Security Advisories
Security news · Cisco security advisories
Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability
Security news · Cisco security advisories

Show the other 20 entries

Cisco Identity Services Engine 802.1X Session Hijack and Information Disclosure Vulnerabilities
Security news · Cisco security advisories
Cisco Identity Services Engine Authentication Bypass Vulnerability
Security news · Cisco security advisories
Cisco Identity Services Engine Authorization Bypass Vulnerabilities
Security news · Cisco security advisories
Cisco Identity Services Engine Command Injection Vulnerabilities
Security news · Cisco security advisories
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
Security news · Cisco security advisories
Cisco Identity Services Engine Hardening Release: September 2026
Security news · Cisco security advisories
Cisco Identity Services Engine Information Disclosure Vulnerability
Security news · Cisco security advisories
Cisco Identity Services Engine Multiple Path Traversal Vulnerabilities
Security news · Cisco security advisories
Cisco Identity Services Engine SQL Injection Vulnerabilities
Security news · Cisco security advisories
Cisco Identity Services Engine SQL and HQL Injection Vulnerabilities
Security news · Cisco security advisories
Cisco Nexus Dashboard Software Security Hardening Release: September 2026
Security news · Cisco security advisories
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Management Center Software Vulnerabilities
Security news · Cisco security advisories
Cisco Secure Firewall Management Center Software Vulnerabilities
Security news · Cisco security advisories
Cisco Secure Firewall Management Center Software sftunnel Root Arbitrary Code Execution Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability
Security news · Cisco security advisories
Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability
Security news · Cisco security advisories
Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability
Security news · Cisco security advisories

15 Sep 2026

SecurityAtlassian Jira and Confluence42 source records

Security advisory · 42 entries

Confluence Data Center: MITM (Man-in-the-Middle) Netty Dependency (CVE-2026-45674)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it critical
Confluence Data Center: MITM (Man-in-the-Middle) Netty Dependency (CVE-2026-47691)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it critical
Jira Service Management Data Center: DoS (Denial of Service) linkify-it Dependency (CVE-2026-48801)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high

Show the other 39 entries

Jira Service Management Data Center: DoS (Denial of Service) linkify-it Dependency (CVE-2026-59887)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center and Server: BASM (Broken Authentication & Session Management) Apache Tomcat Dependency (CVE-2026-53434)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it critical
Jira Software Data Center and Server: BASM (Broken Authentication & Session Management) Apache Tomcat Dependency (CVE-2026-55276)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it critical
Jira Software Data Center and Server: BASM (Broken Authentication & Session Management) Bouncy Castle Dependency (CVE-2026-12816)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center and Server: BASM (Broken Authentication & Session Management) Bouncy Castle Dependency (CVE-2026-59642)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center and Server: DoS (Denial of Service) Apache Tomcat Dependency (CVE-2026-13506)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center and Server: DoS (Denial of Service) nanoid Dependency (CVE-2026-67214)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: Apache Tomcat: Bad ornext processing in RewriteValve (CVE-2026-53404)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: BASM (Broken Authentication & Session Management) Bouncy Castle Dependency (CVE-2026-12802)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: BASM (Broken Authentication & Session Management) Bouncy Castle Dependency (CVE-2026-59639)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: BASM (Broken Authentication & Session Management) org.bouncycastle:bcprov-jdk18on Dependency (CVE-2026-8763)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it critical
Jira Software Data Center: CSRF (Cross-Site Request Forgery) nanoid Dependency (CVE-2026-73086)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DOM-based XSS tinymce Dependency (CVE-2026-47759)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DOM-based XSS tinymce Dependency (CVE-2026-47761)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DOM-based XSS tinymce Dependency (CVE-2026-47762)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) Apache Tomcat Dependency (CVE-2026-58059)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) brace-expansion Dependency (CVE-2026-14257)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) brace-expansion Dependency (CVE-2026-69152)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) browserslist Dependency (CVE-2026-73088)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) browserslist Dependency (CVE-2026-73089)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency (CVE-2026-54512)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) immutable Dependency (CVE-2026-59879)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) immutable Dependency (CVE-2026-59880)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) io.netty:netty-codec Dependency (CVE-2026-73507)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) js-yaml Dependency (CVE-2026-59869)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) node-tar dependency tar Dependency (CVE-2026-73566)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency (CVE-2026-68763)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: File Inclusion postcss Dependency (CVE-2026-73646)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: Information Disclosure axios Dependency (CVE-2026-67320)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: Injection fast-uri Dependency (CVE-2026-13676)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: Injection fast-uri Dependency (CVE-2026-16221)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: Injection fast-uri Dependency (CVE-2026-18446)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: Injection json5 Dependency (CVE-2022-46175)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: RCE (Remote Code Execution) @babel/plugin-transform-modules-systemjs Dependency (CVE-2026-44728)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency (CVE-2026-58060)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: SSRF (Server-Side Request Forgery) fast-uri Dependency (CVE-2026-75899)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: SSRF (Server-Side Request Forgery) fast-uri Dependency (CVE-2026-75975)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: SSRF (Server-Side Request Forgery) fast-uri Dependency (CVE-2026-76172)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high
Jira Software Data Center: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (CVE-2026-54513)
Security advisory · Atlassian security advisories
Assessment context
The vendor rates it high

15 Sep 2026

SecurityMicrosoft Edge2 source records

Published vulnerability · 2 entries

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Published vulnerability
CVE-2026-85893
Assessment context
Microsoft states that customer action is required
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Published vulnerability
CVE-2026-69486
Assessment context
Microsoft states that customer action is required

15 Sep 2026

Updates and guidanceDefender

Defender for Endpoint iOS 1.1.81140101

Product news · Defender for Endpoint iOS releases

15 Sep 2026

SecurityCloudflare

WAF - WAF Release - 2026-09-15

Security advisory · Cloudflare WAF changelog

Assessment context

15 Sep 2026

SecurityMicrosoft Security Community Blog

From DLP Alert Volume to Measurable Detection Assurance

Security news · Microsoft Security Community Blog

15 Sep 2026

SecurityOracle Database / Oracle E-Business Suite / Oracle Java / Oracle WebLogic Server

Oracle Critical Security Patch Update Advisory - September 2026

Security news · Oracle Security Alerts

14 Sep 2026

SecurityCisco

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco · exploited, added to CISA KEV

CVE-2026-76461

Assessment context

CISA lists it as exploited

14 Sep 2026

SecurityWindows

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Published vulnerability

CVE-2026-85921

Assessment context

Microsoft rates the vulnerability Critical · Microsoft states that customer action is required

Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.