IT security 2026-09-08

Level Critical — 87/100 — 2026-09-08

Critical day: 19 stories ranked, 4 of the top 10 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Microsoft Windows Link Following Vulnerability (79/100).

  1. Microsoft Windows Link Following Vulnerability — 79/100 (CVE-2026-81963)
  2. Microsoft Windows Heap-Based Buffer Overflow Vulnerability — 79/100 (CVE-2026-85880)
  3. Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability — 68/100 (CVE-2026-75650)
  4. N-able N-central Static Code Injection Vulnerability — 67/100 (CVE-2026-86218)
  5. CVE-2026-78623 — The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queri… — 38/100 (CVE-2026-78623)
  6. microsoft sql server 2017: Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. — 38/100 (CVE-2026-67631)
  7. microsoft sql server 2022: Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. — 38/100 (CVE-2026-67643)
  8. microsoft windows 10 1607: Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthor… — 38/100 (CVE-2026-72950)
  9. commvault commvault: Command Center API contained an authentication bypass issue affecting privilege management. — 36/100 (CVE-2026-77089)
  10. CVE-2026-73309 — XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allow… — 35/100 (CVE-2026-73309)