CPE
Microsoft September 2026 Patch Tuesday Addresses Two Actively Exploited Zero-Days
1 TTP 2 CVEsMicrosoft's September 2026 update cycle addresses 974 vulnerabilities, including two privilege-escalation zero-days actively exploited in the wild and 20 potentially wormable RCE flaws.
Active Exploitation of Google Chromium V8 Type Confusion Vulnerability
1 TTP 2 CVEsA type confusion vulnerability in the Google Chromium V8 engine is being actively exploited in the wild, allowing remote attackers to achieve arbitrary code execution within the sandbox environment via crafted HTML pages.
Microsoft Security Updates - September 2026
71 CVEsRoundup of Microsoft security advisories published in September 2026.
August 2026 Microsoft Security Update Analysis
1 TTP 5 CVEsMicrosoft's August 2026 security release addresses 415 vulnerabilities, including a zero-day (CVE-2026-68820) exploited in the wild that enables local privilege escalation in the Windows Ancillary Function Driver for WinSock.
Suspicious Child Processes of consent.exe
1 rule 3 TTPs 1 CVEDetection of unauthorized child process creation by the Windows UAC consent.exe binary, a common indicator of UAC bypass and privilege escalation activity.
Microsoft Security Updates — August 2026
29 CVEsRoundup of Microsoft security advisories published in August 2026.
Microsoft Addresses Two Actively Exploited Zero-Day Vulnerabilities in July 2026 Patch Tuesday
8 TTPs 4 CVEs 8 IOCsMicrosoft's July 2026 Patch Tuesday addressed 622 vulnerabilities, including two actively exploited zero-day elevation of privilege flaws, CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint, allowing local and remote attackers to gain administrative control.
CVE-2026-63030: Critical Remote Code Execution Vulnerability in WordPress Core
2 TTPs 15 CVEs 8 IOCsCVE-2026-63030 is a critical unauthenticated remote code execution vulnerability affecting WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, allowing an unauthenticated attacker to execute arbitrary code via the WordPress REST API batch endpoint, potentially leading to complete website compromise.
Microsoft Security Updates — July 2026
5 CVEsRoundup of Microsoft security advisories published in July 2026.
Windows Snipping Tool NTLMv2 Hash Hijack Vulnerability (CVE-2026-33829)
2 rules 1 TTP 1 CVEA local exploit has been published for Windows Snipping Tool (CVE-2026-33829), enabling NTLMv2 Hash Hijacking by forcing authentication to a remote SMB server via a crafted ms-screensketch:edit URI, potentially leading to credential theft and lateral movement.
Windows Server Update Service (WSUS) Privilege Escalation via CVE-2026-26174
2 rules 1 TTPCVE-2026-26174 is a race condition vulnerability in Windows Server Update Service that allows an authorized attacker to elevate privileges locally.
DNS Kerberos Coercion Attempt Detection
3 rules 3 TTPs 4 CVEs 4 IOCsThis brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.