PatchDayAlert
Subscribe →

A sample of the latest issue

AUG 17 · Nº081
Patch now From AUG 17 · Nº081
CVE-2026-59124 9.8 Microsoft HPC Pack

An attacker can send malicious serialized data to Microsoft HPC Pack 2019 over the network and get code execution, no authentication required.

The call: Apply the latest Microsoft security update for HPC Pack 2019 and verify your HPC head nodes are not exposed to the internet.

Sources: MSRC Read the full call

Plus 4 more calls in the latest issue. See the whole thing

01

Source-linked

Every verdict links to a primary source.

NVD, CISA KEV, MSRC, GHSA, or a vendor PSIRT. Skeptical readers can click through to verify in place.

02

Human-reviewed

A working sysadmin edits before it ships.

Issues are reviewed and edited before they go out, not auto-published from a feed. CVEs that aren’t actionable before standup don’t make the cut.

03

Editorial verdicts

One call per CVE. Four minutes total.

Patch now, patch this week, track, or doesn’t apply. These reviews are editorial and unpaid.

Today's digest, in full

The other 4 calls for Monday, August 17.

Read the issue
01 Patch this week CVE-2026-74516 Linux kernel A bug in KVM's SVM (AMD) nested virtualization lets a guest VM read host APIC state, send arbitrary interrupts, and DoS the host. The call: Update your Linux kernel to the patched version from your distro's security channel. CVSS 8.2 02 Patch this week CVE-2026-65767 Microsoft Teams A cross-site scripting (XSS) bug in Microsoft Teams for Android lets an authenticated attacker inject malicious content that can spoof UI elements over the network. The call: Push the latest Microsoft Teams for Android update through your MDM solution or verify users update from the Google Play Store. CVSS 8.8 03 Patch now CVE-2026-57104 Azure Storage Explorer An XSS vulnerability in Azure Storage Explorer lets an unauthenticated attacker escalate privileges over the network. The call: Update Azure Storage Explorer to the latest version from the Microsoft download page or through your software deployment tool. CVSS 8.8 04 Patch this week CVE-2026-50523 Microsoft PowerShell A command injection bug in Microsoft PowerShell lets an authorized local attacker execute arbitrary code. The call: Update PowerShell to the latest patched version via Microsoft Update, winget, or your package manager. CVSS 7.8

The four-verdict model

Every CVE gets one of these four calls.

No CVSS-jargon dump, no “threat actor postulated to leverage” sentences. You read the verdict, then the one-line action, then move on.

  1. Patch now

    Exploited in the wild, or exposed and trivially exploitable. Today’s change window.

  2. Patch this week

    Real risk, no active exploitation yet. Slot it into your next maintenance window.

  3. Track

    Worth knowing about. No action needed today; check back if the advisory changes.

  4. Doesn't apply

    Affected versions you don’t run, or a vendor branch you’ll never see. Skip with confidence.

Who reads this

Built for IT teams who do their own patching.

For sysadmins

The lone admin running fifty servers.

You don’t have time to read three feeds and a Discord. One email, one verdict per CVE, before standup.

Built for this

For MSPs

Twenty clients, twenty stacks.

Each CVE is tagged by vendor and product, so a quick scan picks out what matters to your fleet. Forward the digest to whoever’s on rotation.

Built for this

For IT managers

Brief leadership in one paragraph.

The intro summarizes what shipped, what’s on fire, and what to ignore. Forwardable in one click to whoever signs off on the change window.

Built for this

For lean IT teams

No Tenable, no Qualys, no full-time analyst.

The digest is the triage layer you don’t have to staff.

Built for this

The archive

Recent digests.

Full archive
Nº081 AUG 17

HPC Pack 9.8 deserialization RCE, KVM guest-to-host escape, and Teams XSS

Microsoft HPC Pack 2019 has a no-auth remote code execution bug via serialized payloads (CVE-2026-59124, CVSS 9.8). Also: a KVM nested-virt flaw lets AMD guests DoS the host (8.2), XSS in Teams for Android (8.8) and Azure Storage Explorer (8.8), plus a local PowerShell command injection (7.8). Nothing exploited in the wild yet, but that HPC Pack attack surface is trivial.

5 CVEs
1 Crit
0 KEV
4 min
Nº080 AUG 15

Edge heap overflow, a 9.8 SQLi with full PoC, and a PowerShell privesc

CVE-2026-72970 hits Edge with unauthenticated remote code execution (CVSS 8.3), Metacat's REST API is wide open to unauthenticated SQL injection with public exploits (CVSS 9.8), and a PowerShell command injection gives local attackers an easy privilege escalation path (CVSS 7.8). WordPress and AllData bugs round it out.

5 CVEs
1 Crit
0 KEV
4 min
Nº079 AUG 14

ManageEngine auth bypass hands attackers the keys to your vault

CVE-2026-12263 (CVSS 8.8) lets unauthenticated attackers walk past SAML validation in Password Manager Pro and PAM360. Also: SQL injection in Hongjing e-HR, a KVM s390 host memory corruption bug, an IBM i privilege escalation, and a cross-tenant boundary break in Multicluster Engine.

5 CVEs
0 Crit
0 KEV
4 min
Nº078 AUG 13

FortiWeb auth bypass, two 9.9 Kubernetes privescs, and a zero-auth Android takeover

FortiWeb lets anyone log in with any credentials (CVE-2026-26035, CVSS 9.8). Two CVSS 9.9 bugs in Red Hat MCE and RHACM let namespace-scoped users escalate to full cluster compromise. Microsoft's UFO framework exposes unauthenticated device control on two open ports.

5 CVEs
5 Crit
0 KEV
4 min

From the blog

Playbooks the digest can't fit.

Visit the blog
JUL 18 · Field Note · Colten Anderson

Close the gap between your declared policy and what the box is actually running

A one-off registry edit closes a ticket and never makes it back into the GPO. Here's the three-surface audit that catches the drift, plus the one decision that actually closes the loop.

Read JUL 18 · Field Note · Colten Anderson

Audit your suppression graveyard before a live page dies in it

Silences, downtimes, and maintenance windows get created for good reasons and never revisited. Here are the enumeration commands and three cleanup flags that find the ones that have quietly gone bad.

Read JUL 13 · Field Note · Colten Anderson

Five checks for Intune driver update policy coverage

Windows Autopatch manages your OS updates. Your kernel-level drivers are on their own unless you built a separate driver update policy. Here is how to tell if yours is missing and how to fix it.

Read

Start here

The ones worth reading first.

All posts

Get the cheat sheet and the digest

CVE triage for sysadmins in five minutes.

What to patch now. What can wait. What you can ignore.

  1. 01 The CVE triage cheat sheet, a one-page printable decision tree, in the welcome email.
  2. 02 The weekly digest, one email every Wednesday, around four minutes to read.

Free. Unsubscribe anytime.