974 Microsoft Flaws Addressed in Patch Tuesday; SAP Patches Max-Severity Kernel Flaw; IDScan Confirms Breach

Microsoft has issued its September 2026 Patch Tuesday release, publishing security updates that address 974 vulnerabilities in its products. Two of the flaws are previously undisclosed and known to be exploited, both carrying CVSS score 7.8 and allowing an authorized local attacker to elevate privileges: CVE-2026-81963 stems from improper link resolution before file access in Windows Update Stack, and CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC). Both of these have been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog (CISA KEV). CrowdStrike assesses that 45% of the flaws addressed in this release involve privilege elevation, with the next largest categories being remote code execution at 26% and information disclosure at 18%; the remaining 11% is divided between denial of service, security feature bypass, spoofing, and tampering. Dustin Childs at the Zero Day Initiative highlights five other important flaws to prioritize: CVE-2026-55007, allowing remote code execution in Microsoft Exchange Server; CVE-2026-80097, allowing elevation of privilege in Microsoft Authenticator; CVE-2026-69465, allowing remote code execution in Microsoft Office SharePoint; CVE-2026-65669, allowing elevation of privilege in Microsoft SQL server; and CVE-2026-69525, allowing remote code execution in Remote Desktop Services. Childs indicates that 20 of the patched flaws could be classified as wormable. The SANS Internet Storm Center has published a full detailed list of this month’s flaws. The next largest Microsoft Patch Tuesday release to date was in July, addressing 622 CVEs — approximately five times the number in May and ten times the number in February.

SAP has published security updates addressing 20 vulnerabilities in its products, including a maximum-severity flaw reported by Onapsis, dubbed "OVERPASS," that affects the SAP kernel through its processing of the Extended Passport (EPP). CVE-2026-44756, CVSS score 10.0, allows a remote unauthenticated attacker to run arbitrary OS commands on the SAP host with administrative privileges by crafting a network request with a malformed EPP header that exploits a memory safety vulnerability. Onapsis explains that "because EPP is processed as the session opens, every SAP control that decides who may do what, including user locks, roles, authorization objects and logon policies, is evaluated later than the point where the flaw is reached," and notes the difficulty of mitigation due to the EPP processing kernel code being used by more than one protocol, making it reachable from the internet-facing web layer, from the end users' SAP GUI layer, and from the RFC layer linking SAP systems together. The patch is the only definitive fix. Any SAP solution built on the SAP kernel inherits the flaw, including "SAP S/4HANA, SAP ERP and the SAP Business Suite (ECC), SAP NetWeaver Application Server ABAP, the SAP Web Dispatcher, SAP BW/4HANA, SAP Enterprise Portal, SAP PI/PO, SAP Solution Manager," and others. Onapsis recommends users first check their kernel release and patch level against the latest security note and determine possible exposure, building an accurate inventory. Internet-facing systems should be patched first, followed by internal systems, and users should work to reduce reachability and monitor for any exploitation attempts. The other three critical flaws addressed in the advisory are CVE-2026-58240, a missing authentication check in SAP NetWeaver (Message Server); CVE-2026-76969, credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP); and CVE-2026-66768, improper access control in SAP NetWeaver (SAP GUI for Java).

Louisiana-based ID verification company IDScan has confirmed that evidence of a data breach was discovered during an investigation that began on September 1, the same day Brian Krebs reported that a dark web site was selling ID document scans belonging to over 170 million people in the US and Canada. Krebs saw signs pointing to IDScan as the possible source for the leaked documents, and the FBI opened an investigation. Upon learning of indications that customer data had been accessed, IDScan secured its systems and engaged third-party specialists to investigate, ultimately determining that information including "full names and driver’s license or other government-issued identification numbers" may have been accessed and/or copied without authorization from customer accounts and the IDScan[.]net cloud. IDScan is reviewing its data security policies and procedures, and is cooperating with federal law enforcement as investigation continues. At the time of this writing, IDScan has not described the timing, nature, or full scope of the breach. The company is notifying potentially impacted customers and offering them free credit monitoring and identity protection services, and the security notice encourages vigilance against suspicious account activity, including taking measures like fraud alerts and credit freezes. As described in NewsBites 28.66, Krebs had observed the site "Nexus" selling scans of over 153 million driver’s licenses (including his own), over 10 million identification cards, over 1.9 million travel documents, over 1.3 million international IDs, more than half a million medical cards, and millions of other official documents.

The US Federal Bureau of Investigation's (FBI's) Cyber Division has published a Cyber Strategy that "defines [the agency's] priorities, objectives, and framework for countering malicious cyber activity directed at the United States." The Strategy rests on four foundational pillars: (1) Investigate, Disrupt, and Impose Cost on Cyber Adversaries, (2) Support Victims, (3) Increase Impact Through Partnerships, and (4) Enhance FBI's Cyber Capabilities. The Strategy describes the current cyber threat landscape as being "shaped by two overlapping forces: disciplined, state-sponsored actors leveraging national power to penetrate US networks and critical infrastructure for intelligence collection and disruption, and a mature, profit-driven criminal marketplace that industrializes ransomware, fraud, and cryptocurrency theft." The document calls for increasing the cadence of disruptive operations against cyber criminals and the participation of private sector companies. While the FBI has developed cyber strategies in the past, this is the first one to be released publicly.

The role of state governments in protecting critical infrastructure from cyber threats was examined in a report published by The National Association of State Chief Information Officers (NASCIO) and General Dynamics Information Technology (GDIT). The research investigates “how states are expanding whole-of-state cybersecurity models, supporting local governments and special districts and addressing persistent challenges including limited authority, local capacity gaps, unstable funding and vulnerable operational technology." The report indicates that "Whole‑of‑state cybersecurity models” are becoming the primary framework for critical infrastructure cyber resilience, despite wide variations in centralization, authority and maturity, and gaps in funding for critical infrastructure cyber protection (CICP) for local governments and special districts. The report concludes with suggestions for addressing CICP at the state, local, and special district levels. Data for the report were drawn from the 2026 NASCIO State CIO Survey, the 2026 NASCIO-Deloitte Cybersecurity Study and interviews with state CISOs.

Pennsylvania-based AdaptHealth has released additional information about a June 5, 2026 breach involving the theft of patient data. AdaptHealth filed Form 8-K with the US Securities and Exchange Commission (SEC) in July 2026, disclosing that the company was investigating a security incident involving exfiltration of company data. In that filing, AdaptHealth wrote that "the incident was the result of a successful social engineering attack that compromised a user session associated with a third-party contractor," and noted that they had been contacted by a threat actor who claimed to have taken information from AdaptHealth systems. AdaptHealth "confirmed that certain data was exfiltrated from its systems including a stored password file associated with insurance billing; the Company also has confirmed that certain external electronic health record system portals were accessed by the threat actor." In the course of an ongoing investigation, "the Company determined that the incident is material, due to the nature and potential volume of the data that is at risk." More recently, AdaptHealth notified the US Department of Health and Human Services Office for Civil Rights (HHS OCR) that the incident affected 4,115,802 individuals.

In a September 8, 2026 Form 8-K filing with the US Securities and Exchange Commission (SEC), medical device manufacturer Boston Scientific disclosed that an August 2026 cyberattack on its network "is likely to have a material impact on the Company’s results of operations for the third quarter and full year 2026." Boston Scientific detected the incident on August 25 and filed an initial Form 8-K the following day. The incident disrupted the company's global operations network, impacting manufacturing, order processing, and shipping. The new filing indicates that the company has made progress recovering from the incident, with "substantial restoration of its distribution network, with major distribution centers now processing and shipping customer orders at or above normal operating levels." The specifics of the attack have not been disclosed, and no one has claimed responsibility for the breach. An investigation is ongoing.

Google has patched two exploited flaws in Chrome, one among 12 security updates with Chrome 152.0.7977.82/.83, and the other among 230 security updates with Chrome 153. Both vulnerabilities carry CVSS score 8.8 and allow a remote attacker to execute arbitrary code inside the sandbox by using a crafted HTML page to exploit flaws in V8 in Google Chrome. CVE-2026-85046, fixed on September 3, does this by exploiting type confusion. This flaw was reported to Google by Salvatore Gulizia, earning a $1,000 bug bounty. CVE-2026-87491, fixed on September 8, exploits an out-of-bounds write. This flaw was reported to Google by Jihyeon Jeong, a research intern at Compsec Lab at Seoul National University, earning a $2,500 bug bounty. Google has not disclosed additional information about the exploitation in the wild, but both flaws have been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog (CISA KEV). Plex published an advisory on September 1 urging server owners to update to Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to "address a number of security issues" that as of this writing are still awaiting CVEs and public descriptions. Users with automatic updates turned on should ensure their software is the latest available version. Plex also provides instructions to install the update manually on Windows, macOS, Ubuntu, and Fedora/CentOS, through Docker, on NVIDIA Shield, and on NAS systems, making a special note that users running Plex Media Server on NAS devices may not see the updated version in their package manager and should start by downloading the proper files from the Plex downloads page. A week after the advisory, Shadowserver observed over 36,000 unpatched Plex Media Server instances still exposed to the internet.

Earlier this week, Adobe published 10 security bulletins to address more than 170 vulnerabilities across its product lines, including several flaws with critical ratings. CVE-2026-75650, CVSS score 10.0, is an issue of improper neutralization of special elements used in a template engine in Adobe Commerce, and it is being exploited in the wild. Adobe has released a hotfix to address the vulnerability in Adobe Commerce and Magento Open Source. A second bulletin addressing vulnerabilities in Adobe Commerce includes updates addressing additional critical vulnerabilities; the flaws addressed in the second bulletin do not appear to be under active exploitation. Other products affected by critical vulnerabilities include ColdFusion, Photoshop, Illustrator, Animate, Acrobat and Reader, and Campaign Classic. Adobe assigns priority ratings to updates: Priority 1 indicates that the vulnerabilities addressed in the update are either being actively targeted or are likely to be targeted; these updates be installed as soon as possible. Priority 2 indicates that the affected product has historically been at an elevated risk for attack, but there are no known exploits; these updates be installed soon. Priority 3 indicates an update for a product that has not historically been targeted by attackers; these updates should be installed at administrators' discretion. Of the bulletins released this week, three have been designated Priority 1: Adobe Commerce | APSB26-146; Adobe ColdFusion | APSB26-119; and Adobe Campaign Classic | APSB26-142.

A known vulnerability in WatchGuard Fireware OS for Firebox devices is being exploited in ransomware attacks. The US Cybersecurity and Infrastructure Security Agency (CISA) added the critical out-of-bounds write vulnerability (CVE-2025-14733, CVSS score 9.3) to the Known Exploited Vulnerabilities (KEV) catalog in December 2025. At that time, the vulnerability was flagged as being actively exploited, but the field indicating whether or not the vulnerability was being exploited in ransomware attacks was set to "Unknown." That field was updated earlier this week to "Known," though CISA does not publish alerts when the content of that field changes in KEV entries. Experts urge organizations to patch vulnerabilities added to the KEV sooner rather than later regardless of the ransomware field flag designation. Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, notes that in 2025, CISA changed the ransomware field from "Unknown" to "Known" for 59 CVEs; the period of time between the addition of the CVE to the database and the field change ranged from one day to more than three-and-a-half years. According to Krell, "The gap reflects CISA's confirmation timeline. Ransomware operators were almost certainly exploiting this within days of disclosure."