TL;DR Pega disclosed a Pega Platform SAML authentication bypass on September 18, 2026. It covers two flaws, one Critical (CVSS 9.5) and one High (CVSS 7.0). Pega has released patches and hotfixes. No compromise has been reported so far. Why This Pega Platform SAML Bypass Matters Pega Platform runs core workflows at many large enterprises, banks, and government agencies. SSO ties those apps to a single sign-on layer.

the company stated in an advisory read more about Palo Alto Networks Patches Authentication Bypass Exploit in PAN-OS Software

attacks to guess legitimate credentials read more about Moxa Issues Fix for Critical Authentication Bypass Vulnerability in PT Switches

This lab uses an OAuth service to allow users to log in with their social media account. Flawed validation by the client application makes it possible for ...

An online platform for learning and teaching cyber security, all through your browser.

TL;DR A flaw in pgAdmin 4 allows remote actors to bypass authentication when Webserver mode is active. Specifically, attackers can forge identity headers to log in as administrators without passwords. Therefore, organizations must deploy version 9.18 immediately to secure their database environments. Why This Threat Matters Sourced industry estimates indicate that millions of developers and administrators use pgAdmin to manage PostgreSQL deployments.

TL;DR JetBrains fixed three security flaws across Hub, YouTrack, and GoLand. The worst is a JetBrains authentication bypass scored CVSS 10 (CVE-2026-50242). The company found no sign of real-world abuse. Why It Matters JetBrains tools reach more than 15 million developers, by the company's own count. That figure shows the scale of its install base, though direct exposure here is narrower.

🚨 CRITICAL VULNERABILITY ALERT — Network Edge / Remote Access Infrastructure: MikroTik shipped a silent, no-detail patch for RouterOS on September 3, 2026, hoping to buy administrators time before attackers reverse-engineered the flaw. CERT Polska has now confirmed the exploited chain — nicknamed MikroTrick — was already running in the wild since September 2, a full day before the patch existed…

BleepingComputer, publié le 2 septembre 2026. L'article rapporte l'exploitation active d'une vulnérabilité critique dans JFrog Artifactory, un gestionnaire de dépôts logiciels largement utilisé pour stocker, organiser, sécuriser et distribuer des packages.

Corporate email can fall into an attacker's hands after the compromise of a single low-privilege account. Nearly 22,000 internet-facing Microsoft Exchange servers have not received the fix for CVE-2026-62911, a flaw that allows every employee's mailbox to be seized. An Authentication Bypass by Capture-Replay Microsoft rated the vulnerability 8.0 out of 10 on the CVSS 3.1 scale and classified it as an authentication bypass by capture-replay.

https://www.osintinvestigate.com WordPress website owners are facing a new security threat involving the MiniOrange SAML 2.0 Single Sign-On plugin. Two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981, are being actively exploited in opportunistic attacks against websites running vulnerable versions of the plugin.

Critical JFrog Artifactory flaw CVE-2026-82329 actively exploited; patches released 8/28. Manual updates needed for on-prem. Admin access risks. Enterprises urged to patch.

Two actively exploited PaperCut vulnerabilities can be chained for pre-auth RCE. Validate exposure with NodeZero® Rapid Response.

TL;DR A critical Artifactory authentication bypass vulnerability allows unauthenticated threat actors to obtain administrative privileges. Security researchers warn that this severe weakness is currently exploited in the wild. JFrog rates it 9.8 on the CVSS scale. Why It Matters JFrog Artifactory operates as a vital central repository for corporate software components, container images, and deployment packages. Threat actors who obtain administrative privileges can alter source code, inject malware, or steal sensitive intellectual property.

TL;DR Cisco released hardening updates for Secure Workload on August 19, 2026. The Cisco Secure Workload authentication bypass and privilege escalation flaws include two vulnerabilities rated CVSS 10. Cisco found the bugs internally and reports no exploitation in the wild. Why It Matters Secure Workload protects data center and cloud workloads through microsegmentation. A break in its access controls therefore weakens the very tool meant to contain attackers.