Forum Widgets
Recent Discussions
VMware Patches Multiple vCenter Server Vulnerabilities (CVE-2
VMware Patches Multiple vCenter Server Vulnerabilities (CVE-2021-21985, CVE-2021-21986) On May 25, VMware published an advisory (VMSA-2021-0010) regarding two vulnerabilities impacting vCenter Server, a centralized management software for VMware vSphere systems. In a rare move, VMware also published a blog post providing guidance on how users can mitigate these vulnerabilities. Organizations are strongly encouraged to apply patches as soon as possible. For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.
Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs
On June 9, Microsoft released its June 2026 Patch Tuesday release which patched 198 CVEs with 32 rated as critical and 166 rated as important. This month's updates included three zero-days that were publicly disclosed prior to patches being made available. This Patch Tuesday release is the largest release since the Patch Tuesday program began, smashing the previous record of 167 CVEs in the October 2025 Patch Tuesday release. One of the zero-days is CVE-2026-50507, a security feature bypass vulnerability affecting Windows BitLocker. It received a CVSSv3 score of 6.8 and is rated as important. According to Microsoft, an attacker with physical access to the system could bypass the BitLocker Device Encryption feature in order to gain access to the device's encrypted data. This vulnerability appears to be the flaw known as Bitskrieg and a collaboration between Chaotic Eclipse (Nightmare Eclipse) and Jonas L. Chaotic Eclipse or Nightmare Eclipse has published several additional zero-days recently, including BlueHammer (CVE-2026-33825), GreenPlasma, MiniPlasma and YellowKey (CVE-2026-45585). This month’s update includes patches for: .NET ASP.NET Core Active Directory Domain Services Azure HorizonDB Azure Stack Edge Copilot Chat (Microsoft Edge) Function Discovery Service (fdwsd.dll) GitHub Copilot and Visual Studio Code HTTP/2 Linux MANA Driver M365 Copilot Microsoft Azure Attestation service and Device Health Attestation Service Microsoft Azure Kubernetes Service Microsoft Bing Microsoft Copilot Microsoft Defender for Endpoint Microsoft Dynamics 365 (on-premises) Microsoft Exchange Online Microsoft Exchange Server Microsoft Graph Microsoft Graphics Component Microsoft Kinect Microsoft Live Share Canvas SDK Microsoft Office Microsoft Office Click-To-Run Microsoft Office Excel Microsoft Office Project Microsoft Office SharePoint Microsoft Office Word Microsoft PC Manager Microsoft PowerToys Microsoft Teams for Android Microsoft UxTheme Library (uxtheme.dll) Microsoft Windows DNS Nuance PowerScribe Office for Android Remote Desktop Client Role: Windows Hyper-V UI Automation Manager (uiamanager.dll) Universal Plug and Play (upnp.dll) Visual Studio Code Windows Administrator Protection Windows Ancillary Function Driver for WinSock Windows Application Identity (AppID) Subsystem Windows BitLocker Windows Bluetooth Port Driver Windows Bluetooth Service Windows Boot Manager Windows Collaborative Translation Framework Windows Common Log File System Driver Windows Cryptographic Services Windows DHCP Client Windows DHCP Server Windows DWM Core Library Windows Deployment Services Windows HTTP.sys Windows Hotpatch Monitoring Service Windows Hyper-V Windows Internet (wininet.dll) Windows Kerberos Windows Kernel Windows Kernel-Mode Drivers Windows Mark of the Web (MOTW) Windows Media Windows NT OS Kernel Windows NTFS Windows Narrator Braille Windows Network Controller (NC) Host Agent Windows Performance Monitor Windows Program Compatibility Assistant Service Windows Projected File System Filter Driver Windows Push Notifications Windows RDP Windows SDK Windows Secure Boot Windows Shell Windows Storage Windows TCP/IP Windows Telephony Service Windows UEFI Windows Universal Disk Format File System Driver (UDFS) Windows Win32K - GRFX Winlogon For more information, please visit our blog.Key findings from the Verizon DBIR 2026: Slower vulnerability remediation meets faster exploitation
Verizon’s annual Data Breach Investigations Report (DBIR) has helped organizations understand evolving cyber threats since its first release in 2008. For the 2026 edition, Tenable Research once again contributed enriched data on vulnerability exploitation and vulnerability remediation trends. This year’s findings paint a stark picture: Compared with last year, organizations are facing a significant increase in the volume of “must-patch” vulnerabilities from the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. The 2026 Verizon DBIR found that vulnerability exploitation is the top initial access vector, accounting for 31% of data breaches during the study period. Even more concerning is that the median time-to-patch has increased from 32 days to 43 days, a 34% increase. This year’s findings paint a stark picture: The number of vulnerabilities continues to snowball, as organizations’ patching rates continue to fall behind. While vulnerability exploitation dominates headlines as the number one initial access vector, it represents only a slice of the exposure problem. The DBIR notably highlights credential abuse as another significant threat vector, underscoring that vulnerabilities don’t exist in isolation. Stolen credentials can transform a moderate-severity vulnerability into a critical breach pathway, while exposed configurations can provide attackers with the access needed to exploit unpatched systems. This interconnected nature of exposures highlights why more and more organizations are adopting comprehensive exposure management. Understanding and addressing the full attack surface, including identity risks, misconfigurations, excessive permissions, and vulnerable assets, is essential to reducing breach risk in today’s threat landscape. The 2026 DBIR, enriched with Tenable Research’s data, provides valuable insights into today’s threat landscape. Tenable encourages security professionals to read the full Verizon DBIR to understand current attack trends and use these findings to inform their exposure management strategies. In addition, please visit our blog for our analysis and insights into the Tenable data used in the DBIR report.php2shell (CVE-2026-109618, CVE-2026-109619): FAQ about critical PHP remote code execution flaws
On October 20, CVE identifiers for two critical vulnerabilities in PHP began circulating on Hacker News and social media. Later that day, the PHP security team published an advance notice of an emergency security release scheduled for October 21 at 14:00 UTC. Public reporting describes both as remote code execution vulnerabilities, and a video credited to researcher LCFR and Calif.io demonstrates an exploit chain dubbed php2shell. CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 Cloudflare CTO Dane Knecht said the company is seeing early attacks emerging. For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.FAQ about CVE-2026-88771 and CVE-2026-88772: Citrix NetScaler Zero-Day RCE vulnerabilities
On September 27, Citrix published a security bulletin for two NetScaler ADC and NetScaler Gateway vulnerabilities that were exploited against unpatched customer deployments. CVE Description CVSSv4 CVE-2026-88771 Citrix NetScaler ADC and NetScaler Gateway Improper Input Validation vulnerability 9.5 CVE-2026-88772 Citrix NetScaler ADC and NetScaler Gateway Memory Overflow vulnerability 9.5 CVE-2026-88771 affects all deployments with no additional configuration required. CVE-2026-88772 requires DTLS to be enabled, which is the default on VPN virtual servers. Both have been classified as Vulnerabilities of Interest as part of Tenable's Vulnerability Watch. For more information about these vulnerabilities, including patch versions, IoC guidance, and Tenable product coverage, please visit our blog.Zero Click Zero Day in Microsoft Support Diagnostic Tool...
Zero Click Zero Day in Microsoft Support Diagnostic Tool Exploited in the Wild (CVE-2022-30190) On May 30, Microsoft released an advisory for a zero-day in the Microsoft Windows Support Diagnostic Tool (MSDT) that has been exploited in the wild and gained considerable researcher attention over the weekend. CVE-2022-30190 is a remote code execution vulnerability in MSDT that impacts several versions of Microsoft Office, including patched versions of Office 2019 and 2021. An attacker would craft a malicious document, Microsoft Word is common, and send it to their target via email. By exploiting this vulnerability, an attacker can execute commands with the permissions of the application used to open the malicious document. Researchers have found that this vulnerability can be exploited without user interaction. Microsoft has published a workaround and detection information, but no patches as of May 31. For more information, please visit our blog post.Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
On September 8, Microsoft released its September 2026 Patch Tuesday release which patched 964 CVEs with 104 rated critical and 860 rated as important. This update includes patches for two zero-days that were exploited in the wild. To date, this is the largest Patch Tuesday release ever, crushing the previous record from July’s 569 CVEs. CVE-2026-81963 is an elevation of privilege vulnerability affecting Windows Update Stack elevation of privilege vulnerability. It received a CVSSv3 score of 7.8 and was rated as important. According to Microsoft, this vulnerability was exploited in the wild as a zero-day. CVE-2026-85880 is a elevation of privilege vulnerability affecting Windows Advanced Local Procedure Call (ALPC). It received a CVSSv3 score of 7.8 and is rated as important. According to Microsoft, this vulnerability was exploited in the wild, making it the one of two zero-days addressed in the September Patch Tuesday release. Successful exploitation would allow an attacker to gain SYSTEM level privileges. This month’s update includes patches for: .NET .NET and Visual Studio ASP.NET Core Active Directory Certificate Services (AD CS) Active Directory Domain Services Active Directory Federation Services (AD FS) Audio Video Control Transport Protocol Azure Arc Azure CycleCloud Azure HDInsights BranchCache Connected Devices Platform Service (Cdpsvc) Data Sharing Service Client GitHub Copilot and Visual Studio Code Graphic Fonts HID class driver IP Helper Internet Storage Name Service Kernel Streaming WOW Thunk Service Driver Microsoft Account Microsoft Authenticator Microsoft Azure Attestation service and Device Health Attestation Service Microsoft Azure CLI Microsoft COM for Windows Microsoft Dynamics 365 Microsoft Exchange Server Microsoft Graphics Component Microsoft Install Service Microsoft JScript Microsoft Local Security Authority Server (lsasrv) Microsoft Office Microsoft Office Access Microsoft Office Excel Microsoft Office Outlook Microsoft Office PowerPoint Microsoft Office Publisher Microsoft Office SharePoint Microsoft Office Word Microsoft Standard XPS Microsoft Teams for Android Microsoft Trace Data Helper Microsoft UxTheme Library (uxtheme.dll) Microsoft WDAC OLE DB provider for SQL Microsoft WebP Image Extension Microsoft Windows Codecs Library Microsoft Windows Media Foundation Microsoft Windows PDF Microsoft Windows SCSI Class System File Microsoft Windows Search Component Microsoft Windows Speech OpenSSH for Windows Power Automate Push Message Routing Service RPC Runtime Reliable Multicast Transport Driver (RMCAST) Remote Desktop Client Remote Desktop Gateway Service Role: DNS Server Role: Windows Fax Service SQL Server Skype for Business Spring Cloud Azure Storage Port Driver Telnet Client Virtual Hard Disk (VHD) Miniport Driver Visual Studio Visual Studio Code Volume Manager Driver Windows AF_UNIX Socket Provider Windows ALPC Windows Accounts Control Windows Ancillary Function Driver for WinSock Windows Audio Service Windows Authentication Methods Windows Autopilot Windows Bind Filter Driver Windows Biometric Service Windows BitLocker Windows Bluetooth Port Driver Windows Bluetooth Service Windows Boot Manager Windows Broadcast DVR User Service Windows Broker Infrastructure Service Windows CD-ROM Driver Windows Camera Frame Server Monitor Windows Cloud Files Mini Filter Driver Windows Compressed Folder Windows Connected User Experiences and Telemetry Windows Container Manager Service Windows Core Messaging Windows Credential Guard Windows Credential Providers Windows DCOM Server Windows DHCP Client Windows DHCP Server Windows DNS Windows DWM Core Library Windows Defender Firewall Service Windows Deployment Services Windows Device Association Broker service Windows Device Association Service Windows Devices Human Interface Windows Direct Show Windows Display Enhancement Service Windows Distributed File System (DFS) Windows Embedded Mode Service Windows Encrypting File System (EFS) Windows Enterprise App Management Windows Error Reporting Windows Event Logging Service Windows Failover Cluster Windows Fast FAT Driver Windows File History Service Windows GDI Windows GDI+ Windows Graphics Kernel Windows Group Policy Windows HTTP Print Provider Windows HTTP.sys Windows Hello Windows Host Guardian Service Windows Hyper-V Windows IKE Extension Windows IP Address Management (IPAM) Service Windows Image Acquisition Windows Imaging Component Windows Installer Windows Internet Connection Sharing (ICS) Windows Kerberos Windows Kernel Windows Kernel Mode Driver Windows Key Distribution Center Windows LDAP - Lightweight Directory Access Protocol Windows License Manager Windows Link Layer Topology Discovery Protocol Windows MIDI Service Module Windows Management Instrumentation Windows Management Services Windows Media Windows Media Player Windows Message Queuing Windows Message Queuing Queue Manager Windows Microsoft DirectMusic Windows Mobile Broadband Windows Modern Device Management (MDM) Windows Modern Execution Server Windows NDIS Windows NFS Portmapper Windows NTFS Windows Netlogon Windows Network Connection Broker Windows Network File System Windows Notification Windows OLE DB Windows Online Certificate Status Protocol (OCSP) Windows Overlay Filter Windows Paint Windows Partition Management Driver Windows Performance Monitor Windows Power Dependency Coordinator Windows PowerShell Windows Print Spooler Components Windows PrintWorkflowUserSvc Windows Program Compatibility Assistant Service Windows Push Notifications Windows RDP Client Windows RNDIS Windows Raw Image Extension Windows Registry Windows Remote Access Connection Manager Windows Remote Desktop Windows Remote Desktop Licensing Service Windows Remote Desktop Protocol Windows Remote Desktop Services Windows Resilient File System (ReFS) Windows Resilient File System (ReFS) Deduplication Service Windows Routing and Remote Access Service (RRAS) Windows SMB Client Windows SMB Server Windows SMB Server Network Transport Driver (srvnet.sys) Windows Schannel Windows Secure Boot Windows Secure Kernel Mode Windows Secure Socket Tunneling Protocol (SSTP) Windows Security Center Windows Security Health Service Windows Server Windows Services for NFS ONCRPC XDR Driver Windows Setup Files Cleanup Windows Shell Windows Smart Card Windows Spaceport.sys Windows Storage Windows Storage Management Provider Windows Storage Port Driver Windows Storage Spaces Controller Windows TCP/IP Windows Task Scheduler Windows Text Shaping Windows URL Moniker Windows USB Audio Class driver (usbaudio.sys) Windows USB Driver Windows USB Hub Driver Windows USB Mass Storage Class Driver Windows USB Video Driver Windows Universal Disk Format File System Driver (UDFS) Windows Universal Plug and Play (UPnP) Device Host Windows Update Stack Windows VHD miniport driver Windows VOLSNAP.SYS Windows Virtual Trusted Platform Module Windows Volume Manager Extension Driver Windows Volume Shadow Copy Windows Web Platform Storage Windows WebClient Service Windows Win32 Kernel Subsystem Windows Win32K Windows Wireless Networking Windows Wireless Wide Area Network Service Windows Work Folder Service Windows Work Folders Windows exFAT File System Windows iSCSI Windows iSCSI Target Service Winsock XBox Gaming Services Xbox For more information, please visit our blog.Frequently Asked Questions About The August 2025 F5 Security Incident
Starting August 9 2025, F5 learned that a nation-state threat actor gained and maintained access to certain systems within their environment. This included access to F5’s BIG-IP product development systems and “engineering knowledge management platforms.” On October 15, F5 released knowledge base (KB) article K000154696 providing current details on the known impacts of the breach, including an acknowledgement that they have not observed further unauthorized activity and believe they have successfully contained the breach. In response, Tenable’s Research Special Operations (RSO) team has compiled a blog to answer Frequently Asked Questions (FAQ) regarding the security incident affecting F5. Alongside the disclosure of the security incident, F5 also released its October 2025 Quarterly Security Notification. While there is no notice in these security advisories that any of the CVEs released on October 15 have been exploited, we strongly recommend applying all available patches. For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.FAQ on Copy Fail Linux Kernel Privilege Escalation (CVE-2026-31431)
On April 29, researchers at Theori publicly disclosed CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem dubbed "Copy Fail." The flaw has been present in every major Linux distribution since 2017. A public proof-of-concept exploit is available and reported to work reliably, drawing comparisons to Dirty Cow and Dirty Pipe. CVE Description CVSSv3 CVE-2026-31431 Linux Kernel Local Privilege Escalation Vulnerability 7.8 Patched kernel versions are available, though some major distributions have not yet shipped updates. For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs
On August 18, Oracle released its Critical Security Patch Update (CSPU) for August 2026. This CSPU contains fixes for 925 unique CVEs in 943 security updates across 23 Oracle product families. Out of the 943 security updates published, 16.3% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 59%, followed by medium severity patches at 21%. For more information about the August 2026 CSPU release, including the availability of patches and Tenable product coverage, please visit our blog.