Patch now: 11 actively exploited flaws in common business gear (Sep 2, 2026 – Sep 14, 2026)

These flaws are being used in real attacks right now, in equipment and software that small offices commonly run. If you have any of them, install the vendor’s fix this week.

• Cisco Secure Email Gateway — Cisco Secure Email Gateway SQL Injection Vulnerability (CVE-2026-76461), added Sep 14, 2026. Vendor advisory.
• Citrix NetScaler — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-19490), added Sep 9, 2026. Vendor advisory.
• Fortinet Multiple Products — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability (CVE-2025-25249), added Sep 9, 2026. Vendor advisory.
• Google Chromium V8 — Google Chromium V8 Out of Bounds Write Vulnerability (CVE-2026-87491), added Sep 9, 2026. Vendor advisory.
• Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management — Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-20079), added Sep 9, 2026. Vendor advisory.
• Adobe Commerce and Magento — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2026-75650), added Sep 8, 2026. Vendor advisory.
• Microsoft Windows — Microsoft Windows Link Following Vulnerability (CVE-2026-81963), added Sep 8, 2026. Vendor advisory.
• Microsoft Windows — Microsoft Windows Heap-Based Buffer Overflow Vulnerability (CVE-2026-85880), added Sep 8, 2026. Vendor advisory.
• Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability (CVE-2026-85046), added Sep 4, 2026. Vendor advisory.
• SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (CVE-2026-83548), added Sep 2, 2026. Vendor advisory.
• SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances OS Command Injection Vulnerability (CVE-2026-83549), added Sep 2, 2026. Vendor advisory.