patch-management news, stories and analysis

Bar chart of Microsoft September 2026 Patch Tuesday CVEs by product: Windows 723, Office 111, SQL 62, Developer Tools 22, with a total of 974 CVEs.

Microsoft's record 974-CVE patch day buries operators

Microsoft shipped a record 974 CVEs in September 2026 Patch Tuesday, including two actively exploited Windows zero-days. Operators now face a deployment crisis as patch volume overwhelms testing capacity.

Lars Cornelissen · Sep 9, 2026

Abstract data visualization representing N-central RCE vulnerability CVE-2026-86218 with 1,500 exposed servers and CVSS 10.0 severity rating

Cyber security

N-central RCE rated CVSS 10 as N-able ships fourth hotfix

CVE-2026-86218 is a CVSS 10.0 pre-auth N-central RCE flaw in N-able's RMM platform. On-prem servers need build 2026.3.1.14 now, with 1,500 exposed online and active attacks reported.

Lars Cornelissen · Sep 7, 2026

Timeline of ServiceNow CVE-2026-6875 from April 1 discovery to July 18 active exploitation, showing a 5-day gap between July 13 patch release and first attacks. CVSS 9.5.

Cyber security

ServiceNow CVE-2026-6875 exploited: patch your instances now

ServiceNow CVE-2026-6875 is a CVSS 9.5 pre-auth sandbox escape RCE in the AI Platform, now actively exploited. Patch self-hosted instances immediately.

Lars Cornelissen · Jul 21, 2026

Splunk CVE-2026-20253 timeline showing day 0 disclosure on June 10, day 2 public technical write-up on June 12, day 8 CISA KEV addition on June 18, and day 11 federal due date on June 21.

Cyber security

Splunk CVE-2026-20253 puts SIEMs on a 72-hour clock

Splunk CVE-2026-20253 is an actively exploited critical flaw. Patch exposed Enterprise 10.0 and 10.2 nodes by June 21.

Lars Cornelissen · Jun 21, 2026