Yesterday’s Patch Tuesday cycle produced three of today’s four Known Exploited Vulnerabilities catalog additions, plus one more that has nothing to do with Microsoft at all. Here’s what’s new since yesterday’s digest.
Vulnerability watch: Adobe patches a CVSS 10.0 Magento zero-day already used to backdoor stores with all prior patches applied
Adobe shipped an emergency hotfix for CVE-2026-75650, a maximum-severity template-injection flaw in Magento Open Source and Adobe Commerce that e-commerce security firm Sansec is calling StyleSmuggler. The bug lets an unauthenticated attacker write PHP content into a file Magento can later read — an application log or a report — and then trigger Magento’s template-processing chain to load that file through its dependency-injection scanner, achieving remote code execution without a malicious extension or an admin account. Sansec confirmed active exploitation starting September 4, three days before Adobe’s fix landed on September 7; attackers used it to drop a Rust-based Linux backdoor in some intrusions and a PHP web shell in others. Every version from 2.4.4 through 2.4.9 is affected. The fix ships as a composer patch (VULN-39341-composer-patches.zip from repo.magento.com), not a full release. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day Adobe patched it. BleepingComputer · The Hacker News · Sansec
If you run Magento or Adobe Commerce, apply the composer patch today and assume compromise if you were exploitable between September 4 and 7. Adobe’s own guidance is unusually blunt here: rotate the encryption key and every credential it protects — admin passwords, REST/SOAP/GraphQL tokens, OAuth client secrets, payment gateway API keys, database credentials, SSH and deploy keys. A key rotation without a credential rotation leaves the actual attacker foothold in place.
Vulnerability watch: Microsoft’s record September Patch Tuesday closes two zero-days already exploited for SYSTEM privilege escalation
Microsoft’s September 2026 Patch Tuesday landed September 8 as the largest single release of the year — SecurityWeek counted 974 CVEs, other trackers put it in the 964-973 range depending on how chained entries are tallied — including 105 rated critical and two confirmed zero-days. CVE-2026-85880 is a heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem that lets a low-privilege local attacker escalate to SYSTEM; it’s only the second ALPC zero-day Microsoft has patched since April 2023. CVE-2026-81963 is an elevation-of-privilege flaw in the Windows Update Stack, also exploited for SYSTEM access, and the first Windows Update Stack zero-day since 2022. CISA added both to its Known Exploited Vulnerabilities catalog on September 8. BleepingComputer · SecurityWeek
Both zero-days require an attacker to already have local code execution before they matter — so treat any endpoint that’s still running yesterday’s build as one CVE-2026-85880 or CVE-2026-81963 away from full SYSTEM compromise the moment a phishing payload or a rogue script lands on it. Prioritize this patch cycle on hosts you can’t fully trust: shared workstations, jump boxes, and anything internet-facing.
Identity watch: A default FreeIPA and directory-server config lets an anonymous LDAP client walk away with a reusable admin credential
Red Hat disclosed a two-bug chain that turns an out-of-the-box FreeIPA identity management deployment into a path from zero authentication to a Kerberos administrator principal. CVE-2026-76560 (CVSS 7.5) is in the underlying 389 Directory Server: an access-control rule meant to let a logged-in user own their own one-time-password token entry also matches an anonymous client, because an unauthenticated connection’s empty identity satisfies the same “empty stored value” check. CVE-2026-76578 (CVSS 9.8) is in FreeIPA itself — the shipped ACI for self-managed OTP tokens doesn’t restrict which attributes an anonymous client can attach alongside the token entry. Chained together, an anonymous LDAP client can create a token entry with the ownership field left blank, pass the ownership check by being nobody, and write an attacker-controlled Kerberos principal and password into the directory — then add that principal to the administrators group. Red Hat says it reproduced the full chain on a default installation with no prior access at all. FreeIPA fixed its side in 4.13.4; patch the directory-server component alongside it. The Hacker News
This one is dangerous precisely because it needs no misconfiguration — the default rule shape is the vulnerability. If FreeIPA backs authentication for any part of your environment, patch both CVEs together and audit for Kerberos principals or admin-group membership changes you can’t attribute to a known onboarding or provisioning event.
Also noted
SAP’s September patch day fixed 20 vulnerabilities, the most severe being CVE-2026-44756 (CVSS 10.0, dubbed OVERPASS by Onapsis), a memory corruption flaw in SAP Kernel and Web Dispatcher’s Extended Passport Processing. A malformed EPP header in a crafted network request can trigger the bug without authentication, and under narrow timing conditions it can hijack another user’s buffered session. It affects Kernel versions 7.22 through 9.20 — check your landscape against SAP Note 3747649. Onapsis
CISA’s four Known Exploited Vulnerabilities additions on September 8 — the Adobe, both Microsoft, and the N-able N-central flaws covered in yesterday’s and today’s digests — give federal civilian agencies until September 11 and September 22 respectively to patch, depending on the entry. If your organization tracks the KEV catalog as a patch-priority signal rather than just a compliance checkbox, all four landed the same day and are worth a single coordinated push rather than four separate tickets. CISA
Final thought
Three unrelated products, three unrelated vendors, and the same underlying failure mode: code that trusts input it shouldn’t — a log file Magento re-reads as a template, a directory entry an anonymous client should never own, a memory buffer sized for the request it expected rather than the one it got. None of today’s fixes require you to change your architecture, only to apply them before the exploit code that already exists gets pointed at you. If you want a second set of eyes on whether your logging actually surfaces exploitation of the systems in today’s digest before it becomes a breach notice, see our how-to guides or book a discovery call.