TENESYS AI NEWS tracks the most important AI news and explains what changed, why it matters and whether a technology is worth testing.
“Patch” — 7 articles ✕
CISA added two Zammad vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation. CVE-2026-102489 is a session fixation flaw and CVE-2026-102490 involves improper privilege management in the Zammad helpdesk/customer service platform. Federal agencies must remediate under Binding Operational Directive 26-04, and CISA urges all organizations to prioritize these fixes.
CISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize patching this vulnerability on internet-exposed assets, especially where it could grant full control of the system. CISA also recommends all organizations, not just federal agencies, prioritize remediation of KEV-listed flaws.
CERT-EU has updated its advisory on critical vulnerabilities in Microsoft SharePoint Server, confirming active exploitation of CVE-2026-50522 (CVSS 9.8), a deserialisation flaw allowing remote code execution. This is part of a wider series of recently patched critical bugs — CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644 — affecting on-premise SharePoint Server instances, some exploitable without authentication.
Microsoft Threat Intelligence documented exploitation of CVE-2026-73570, an unauthenticated OS command-injection flaw in the Zimbra Collaboration Suite's SNMP notification path. Attackers triggered it via specially crafted emails against internet-facing servers running the optional zimbra-snmp package with SNMP notifications enabled, requiring no authentication or user interaction. Post-exploitation activity included JSP webshell deployment, privilege escalation to root, persistent access, credential and mailbox theft, lateral movement across Zimbra clusters, and custom remote-access malware. Zimbra fixed the issue in version 10.1.20 (released July 20, 2026); the CVE was publicly disclosed August 13, 2026, and Microsoft observed scanning and exploitation activity during the gap between patch availability and disclosure, as well as after.
On 9 September 2026, Check Point released emergency hotfixes for two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103), both with CVSS 9.8, affecting Security Gateway, Security Management Server, and Spark Firewall deployments using Remote Access VPN or Site-to-Site VPN. Both flaws allow unauthenticated remote attackers to execute arbitrary code on affected appliances. CERT-EU urges immediate patching, prioritising internet-facing and perimeter devices.
Citrix disclosed 8 vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway, including 2 critical unauthenticated RCE flaws with CVSS 9.5 that Citrix confirms are being actively exploited. CERT-EU urges immediate patching and compromise assessment for internet-facing appliances. Other flaws include HTTP request smuggling, memory overflow bugs leading to RCE/DoS, a policy bypass, and a TCP ISN prediction issue.
Google announced that its Antigravity SDK now supports running agentic workflows locally and offline, with initial support for Gemma 4 26B A4B running via Google AI Edge's LiteRT. Developers can build agents that run entirely on-device, without cloud API costs or internet dependency. Google also demonstrated a hybrid 'Architect-Builder' pattern where a cloud model (Gemini 3.8 Flash) plans tasks and a local swarm of Gemma 4 26B instances does the heavy execution, keeping source code off the cloud.