vulnerability CVE zero-day patch exploit advisory update KEV
CERT Polska confirmed exploitation on Aug. 17, 2026, 28 days after Zimbra shipped version 10.1.20, and Microsoft has detailed what attackers did once inside.
Atlassian shipped fixes on Oct. 5, watchTowr published a proof-of-concept on Oct. 6, and Previdian's honeypots saw attempts roughly two hours later.
The Sept. 8, 2026 release is Microsoft's largest ever, and two analysts offer different guidance on how much of it matters to most organizations.
Advisories published Oct. 7 and Oct. 8, 2026 cover unauthenticated root-level code execution across NX-API, NGOAM and MPLS OAM on Nexus 3000 and 9000 switches, arriving alongside a separate critical batch for Cisco License software.