PatchDayAlert
Subscribe →

A sample of the latest issue

SEP 15 · Nº107
Patch this week From SEP 15 · Nº107
CVE-2026-78517 8.8 Microsoft Word

An attacker can send a malicious Word document that triggers a heap buffer overflow, giving them code execution on the victim's machine over the network.

The call: Apply the latest Microsoft Office security update via Windows Update or the Microsoft 365 admin center.

Sources: MSRC Read the full call

Plus 4 more calls in the latest issue. See the whole thing

01

Source-linked

Every verdict links to a primary source.

NVD, CISA KEV, MSRC, GHSA, or a vendor PSIRT. Skeptical readers can click through to verify in place.

02

Human-reviewed

A working sysadmin edits before it ships.

Issues are reviewed and edited before they go out, not auto-published from a feed. CVEs that aren’t actionable before standup don’t make the cut.

03

Editorial verdicts

One call per CVE. Four minutes total.

Patch now, patch this week, track, or doesn’t apply. These reviews are editorial and unpaid.

Today's digest, in full

The other 4 calls for Tuesday, September 15.

Read the issue
01 Patch this week CVE-2026-73006 Windows 10 A stack buffer overflow in the Windows Graphics Component lets an attacker run code remotely without authentication. The call: Apply the latest cumulative update for your Windows 10 version via Windows Update or WSUS. CVSS 8.8 02 Patch now CVE-2026-76461 Cisco Secure Email Gateway This is a bad one. The call: Upgrade Cisco AsyncOS to the fixed version listed in Cisco's security advisory immediately. CVSS 9.8 03 Patch now CVE-2026-57148 PraisonAI PraisonAI's platform ships with a hardcoded default JWT signing key ('dev-secret-change-me') that's active whenever the PLATFORM_JWT_SECRET environment variable isn't set. The call: Upgrade praisonai-platform to version 0.1.6 or later, and set a strong, unique PLATFORM_JWT_SECRET environment variable. CVSS 9.8 04 Patch now CVE-2026-92055 Mozilla Firefox A privilege escalation bug in Firefox's DevTools component lets an attacker elevate privileges, potentially gaining code execution beyond the browser sandbox. The call: Update Firefox to version 156 (or Firefox ESR to 153.3) through your browser update mechanism or software deployment tool. CVSS 8.8

The four-verdict model

Every CVE gets one of these four calls.

No CVSS-jargon dump, no “threat actor postulated to leverage” sentences. You read the verdict, then the one-line action, then move on.

  1. Patch now

    Exploited in the wild, or exposed and trivially exploitable. Today’s change window.

  2. Patch this week

    Real risk, no active exploitation yet. Slot it into your next maintenance window.

  3. Track

    Worth knowing about. No action needed today; check back if the advisory changes.

  4. Doesn't apply

    Affected versions you don’t run, or a vendor branch you’ll never see. Skip with confidence.

Who reads this

Built for IT teams who do their own patching.

For sysadmins

The lone admin running fifty servers.

You don’t have time to read three feeds and a Discord. One email, one verdict per CVE, before standup.

Built for this

For MSPs

Twenty clients, twenty stacks.

Each CVE is tagged by vendor and product, so a quick scan picks out what matters to your fleet. Forward the digest to whoever’s on rotation.

Built for this

For IT managers

Brief leadership in one paragraph.

The intro summarizes what shipped, what’s on fire, and what to ignore. Forwardable in one click to whoever signs off on the change window.

Built for this

For lean IT teams

No Tenable, no Qualys, no full-time analyst.

The digest is the triage layer you don’t have to staff.

Built for this

The archive

Recent digests.

Full archive
Nº107 SEP 15

Cisco email gateway RCE at 9.8, two Office buffer overflows, and a hardcoded JWT key

CVE-2026-76461 lets an unauthenticated attacker land root on Cisco Secure Email Gateway with a single poisoned email. PraisonAI ships a default JWT secret that hands over full impersonation. Microsoft Office and Windows Graphics both carry 8.8 heap/stack overflows. Firefox 156 fixes a DevTools sandbox escape.

5 CVEs
2 Crit
0 KEV
4 min
Nº106 SEP 14

PraisonAI's wide-open API lets attackers run OS commands, no auth required

CVE-2026-57125 (CVSS 9.8) is an unauth RCE in PraisonAI's Jobs API via crafted YAML. Also: two Zscaler Client Connector bugs on Android/ChromeOS (CVSS 8.1 each) and two GIMP heap overflows in PSP and ICO file loaders (CVSS 7.8).

5 CVEs
1 Crit
0 KEV
4 min
Nº105 SEP 13

IDM's kernel driver hands out SYSTEM, Orion Visor's hardcoded key leaks every credential

CVE-2026-90493 (CVSS 8.8) is a privilege escalation in Internet Download Manager's idmwfp.sys driver with a public exploit and no vendor response. CVE-2026-90510 (CVSS 8.3) exposes all stored host credentials in Orion Visor through a hardcoded encryption key. Plus unpatched SQLi in Feng Office and a certificate validation failure in Kalkitech ICS gear.

5 CVEs
0 Crit
0 KEV
4 min
Nº104 SEP 12

GitLab CVSS 10.0 file read, Fortinet hardcoded creds, and an Edge use-after-free

An unauthenticated path traversal in GitLab exposes any file on disk (CVE-2026-85706, CVSS 10.0). Fortinet FortiMonitorOnSight ships hardcoded credentials reachable without auth (CVE-2026-84390, CVSS 9.8). Edge gets a Chromium use-after-free at CVSS 8.5, plus MongoDB and MoguBlog fixes.

5 CVEs
2 Crit
0 KEV
4 min

From the blog

Playbooks the digest can't fit.

Visit the blog
JUL 18 · Field Note · Colten Anderson

Close the gap between your declared policy and what the box is actually running

A one-off registry edit closes a ticket and never makes it back into the GPO. Here's the three-surface audit that catches the drift, plus the one decision that actually closes the loop.

Read JUL 18 · Field Note · Colten Anderson

Audit your suppression graveyard before a live page dies in it

Silences, downtimes, and maintenance windows get created for good reasons and never revisited. Here are the enumeration commands and three cleanup flags that find the ones that have quietly gone bad.

Read JUL 13 · Field Note · Colten Anderson

Five checks for Intune driver update policy coverage

Windows Autopatch manages your OS updates. Your kernel-level drivers are on their own unless you built a separate driver update policy. Here is how to tell if yours is missing and how to fix it.

Read

Start here

The ones worth reading first.

All posts

Get the cheat sheet and the digest

CVE triage for sysadmins in five minutes.

What to patch now. What can wait. What you can ignore.

  1. 01 The CVE triage cheat sheet, a one-page printable decision tree, in the welcome email.
  2. 02 The weekly digest, one email every Wednesday, around four minutes to read.

Free. Unsubscribe anytime.