CVEasy Weekly

This Week in Exposure

Week 38 · 2026-W38 · September 14 to September 20, 2026

Three of this week's exposures share one uncomfortable fact. The exploit was already running when the patch arrived. A CVSS 10.0 Magento flaw served attacker PHP for three days before Adobe named it, a ransomware crew detonated a brand new encryptor on the same calendar day N-able shipped its N-central hotfix, and Microsoft's two Windows SYSTEM zero-days were live before Patch Tuesday closed.

The base score saw none of it coming. A 10.0, a pair at 8.2, and two at 7.8 describe severity in the abstract, while the question that decided each one was which of your storefronts answers an unauthenticated GraphQL call, which RMM console faces the internet, and which laptop already clicked a link yesterday. Here is the week, ranked by real exposure and by what attackers are doing right now, not by the number NVD printed.

Top Exposures This Week

1. A Magento GraphQL field that smuggles PHP past a fully patched store

CVE-2026-75650, StyleSmuggler · Adobe Commerce, Magento Open Source, Magento B2B · CVSS 10.0, unauthenticated · CISA KEV since September 8

Magento's GraphQL layer accepts a styles array on several public, unauthenticated queries, and older sanitization treats that value as opaque CSS text rather than checking it for PHP. StyleSmuggler is a two request chain that abuses this. The first request POSTs PHP inside the styles field, and the store writes it to a file it owns, in var/log/system.log through an invalid store code path, in var/report/ files, or inside a customer custom option upload. The second request fires the Payment Transaction Failed Reminder email, whose template filter runs the block directive that instantiates a class before it checks the class is safe, which routes through Magento's dependency injection and includes the seeded file. Rendering alone is the sink. No login, no session, and a store on 2.4.6-p15 current against every prior Adobe advisory still reads clean on a pre-patch scan, because the tell is a request pattern, not a component version.

Risk read: Confirmed in the wild since September 4, three days before the fix. Sansec reconstructed the first campaign from storefront logs: attacker PHP seeded through /graphql, then a Rust implant masquerading as [kworker/u:8:0], later rotating to fc-cache beaconing on UDP 123 to ntp.timesync.to and then chronyd doing in-memory updates so the on-disk binary stops matching /proc. A second operator arrived September 7 with a standalone PHP web shell under pub/media/. Adobe reserved the CVE on September 5 and shipped APSB26-146 with the VULN-39341 composer patch on September 7. CISA added it to KEV on September 8 with a September 11 federal deadline that has already passed. A CVSS 10.0 pins this flat next to every other unauthenticated RCE, which is exactly where it gets lost, because a Magento host holds the crypt key that decrypts saved payment data, the admin session cookies, and outbound credentials to the payment processor. Exposure is top band on an internet-reachable storefront on 2.4.4 through 2.4.9 that allows PHP execution under pub/media/, and a compromise there is a payment-data and supply-chain event, not one host.

Read how a styles field ends in root on a patched store →

2. An N-central auth bypass that turns an RMM console into a delivery channel

CVE-2026-18577 with parent CVE-2026-18556 · N-able N-central, builds before 2026.3.1.10 · CVSS 8.2, CWE-288 · CISA KEV since August 3

CVE-2026-18577 is a CWE-288 authentication bypass, an alternate path to a state the console was only meant to grant after an authentication check. The fix for the parent CVE-2026-18556 closed one route to that state and left a second one open, so an unauthenticated request on the second route lands as a console administrator. What sits behind the console is why this outranks its 8.2. N-central is a remote monitoring and management platform, which means the console is a sanctioned deployment system with an agent already trusted on every managed endpoint. Administrative control on the console is a distribution channel, and a script pushed from the management server to every agent looks exactly like a legitimate patch deployment in telemetry.

Risk read: Confirmed in the wild since August 1, vendor acknowledged, KEV listed within two days. N-able detected the activity on July 31 as a zero day, shipped Hotfix 1 (build 2026.3.1.7) on August 2, then shipped Hotfix 2 (build 2026.3.1.10) on August 6 after finding a further attack path tied to the same CVE. A console sitting at 2026.3.1.7 reports itself as patched to a version-matching scanner while still carrying the August 6 gap, so measure the fix level, not the CVE state. Exposure is top band on a console reachable from the internet on 443 or 8443, and far lower behind a management VLAN over VPN with MFA. Because one console administers many downstream customers, the blast radius crosses a customer boundary and turns one appliance into an incident with other companies' names on it.

Read how the bypass reaches every managed agent →

3. Two Windows SYSTEM zero-days a base-score queue buries under every 9

CVE-2026-81963 and CVE-2026-85880 · Windows Update Stack and ALPC · CVSS 7.8 each, local · CISA KEV since September 8

Two of the four CVEs CISA added to KEV on September 8 are local, both land at CVSS 7.8, and Microsoft says both were exploited before the fix shipped. CVE-2026-81963 is a link-following flaw (CWE-59) in the Windows Update Stack: the SYSTEM service resolves a file path through a link a standard user planted, using object-manager symlinks under \RPC CONTROL\ chained with an NTFS junction from a directory the user owns, and performs its trusted write against the redirect target, giving arbitrary file write as SYSTEM. It is the first Update Stack elevation zero-day reported exploited since 2022. CVE-2026-85880 is a heap overflow (CWE-122) in Advanced Local Procedure Call, the IPC that Chromium sandboxes, Office child processes, and most Windows services use to talk to their brokers. A length mismatch between what the caller sends and the buffer the kernel allocated becomes a controlled write into an adjacent kernel heap chunk, and Microsoft calls out an AppContainer sandbox escape path, so the attacker does not need to break out of a browser first.

Risk read: Both exploited in the wild, both on KEV the day the patches landed, no vendor workaround for either. A queue ranked by base score puts these behind every 8-and-above finding, and a queue ranked by network reach puts them behind every internet-facing one, and neither matches how local privilege escalation is actually used. An LPE is what a foothold turns into a domain compromise: every phishing landing that dropped a stealer, every remote-support installer a helpdesk ran, and every drive-by that hit a browser sandbox yesterday is now sitting on a host with two fresh SYSTEM primitives Microsoft has already seen abused. Exposure is highest on the foothold-realistic population, the contractor laptops, VDI images that allow user-initiated installs, and terminal servers, where thin EDR coverage and a patch window longer than a week leave the primitive live.

Read how a foothold becomes SYSTEM on both paths →

Threat Actor Spotlight

Storm-1175 is a China-based, financially motivated ransomware operation tracked by Microsoft Threat Intelligence, which documented it in April 2026 in a writeup on high-tempo Medusa ransomware against web-facing assets. The crew trades on speed against the patch window, and BleepingComputer reported the N-central campaign as its first observed activity since April. The detail that changes detection engineering is the timing. On August 2, the same day N-able shipped Hotfix 1, Storm-1175 deployed StormEncryptor, a C++ encryptor that appends the .encrypted extension and drops a note named !!!README_FIRST!!!.txt, and that no vendor had ever catalogued. The patch layer was blind because the patch was hours old, and the detection layer was blind because any rule that mapped this actor to Medusa artifacts went stale the moment it shipped in-house tooling, while still reporting as healthy coverage. Microsoft attributes the initial access as likely CVE-2026-18577 rather than confirmed, so treat the coupling as the lesson, not the attribution. Hardening takeaway: diff your N-central job history against your change tickets and treat any bulk job scoped to all managed agents as suspect, because that fan-out is where one console becomes estate-wide reach and it is recorded. In Defender for Endpoint, DeviceProcessEvents | where FileName != ProcessVersionInfoOriginalFileName surfaces renamed tooling like a Cloudflare Tunnel binary posing as conhost.exe or Rclone as lsp.exe in one pass, whatever the crew renames things to this month.

Signed CVEasy threat-intel IOC bundle current as of 2026-09-14. The desktop app verifies the ED25519 signature before import.

Every item this week was live before the fix, which breaks the assumption most backlogs run on, that a patch you have not gotten to yet is a risk you have not taken yet. When the exploit beats the patch, the only ordering that helps is one built on your own exposure and on what attackers are doing today, which is the loop our CTEM platform runs with TRIS, and the loop I want this letter to run for you every Monday.

Patch well,
Chris Boker
Founder, CVEasy AI