Zoom has patched a critical vulnerability in its Windows software that could let an unauthenticated attacker take over user accounts over the network. Tracked as CVE-2026-53412 and rated 9.8, the flaw is an improper input validation issue affecting Zoom Workplace for Windows, the VDI client, and the Meeting SDK before version 7.0.0. Zoom found it internally, shared no technical details, and says there is no evidence of exploitation or public exploit code yet. Because the Windows client sits on millions of corporate desktops and the flaw needs no credentials or user interaction, it poses a broad risk, so applying the latest updates promptly is the key mitigation.
Zimbra is urging customers to update after fixing a critical stored cross-site scripting flaw in the Classic Web Client of its widely used email and collaboration platform. A specially crafted email can run malicious scripts when it is simply opened, potentially exposing mailbox contents, session data, and account settings, and enabling session hijacking or credential theft. The flaw, reported by Google's Threat Analysis Group, has no CVE assigned yet and is not confirmed as exploited, but the group often surfaces bugs used by state-backed actors. Zimbra's web client has been a repeated target: Russian-linked groups have exploited similar cross-site scripting flaws against government and military organizations. Updating to version 10.1.19 fixes it.
Ubiquiti has released fixes for 25 vulnerabilities across its UniFi ecosystem, including several critical flaws that let a network-based attacker fully compromise devices. The most severe, CVE-2026-50746 rated 10.0, is an improper access-control bug in the UniFi Connect application that allows unauthenticated command injection on the host. Others rated 9.9, spanning UniFi Talk, Access, Protect, and UniFi OS, include SQL injection, command injection, and server-side request forgery that lead to privilege escalation, and some can be chained to bypass authentication requirements. The flaws affect widely deployed gateways and consoles like the UDM family. Ubiquiti lists no interim workarounds, so updating each affected product to its fixed version is the only mitigation.
Microsoft has patched RoguePlanet, a Microsoft Defender flaw that a public proof-of-concept had been exploiting since June to gain SYSTEM privileges on fully updated Windows machines. Tracked as CVE-2026-50656, the bug is a race condition in Defender's scanning engine: a low-privileged attacker who already has code running on a host can win a timing window to spawn a command shell as SYSTEM, and the public exploit worked whether or not real-time protection was enabled. It does not provide initial access, but it turns any foothold into full local control, useful for disabling defenses, stealing credentials, and moving laterally. It is the fourth Defender flaw disclosed by the same researcher this year.
BeyondTrust has patched two critical flaws in its Remote Support and Privileged Remote Access products that let an unauthenticated, network-positioned attacker bypass authentication and reach the appliance, including accounts with elevated privileges. The bugs, CVE-2026-40138 and CVE-2026-40139, both rated 9.2, sit in the authentication subsystem and depend on a specific authentication configuration being enabled. Cloud-hosted customers were patched automatically in April, but self-hosted deployments on version 25.3.2 or earlier need to update themselves. BeyondTrust has not reported exploitation, but its remote-support products have a history of being attacked, including flaws used to breach the US Treasury and to deploy ransomware, so internet-facing appliances should be patched quickly.
Adobe has released patches for seven critical, top-rated code execution vulnerabilities in its ColdFusion web application platform and Campaign Classic marketing tool. Six of the flaws affect ColdFusion 2025 and 2023 and stem from unrestricted file uploads, improper input validation, and path traversal, each allowing arbitrary code execution; the seventh, in Campaign Classic, is an authorization flaw with the same impact on on-premises installations. All can be exploited in low-complexity attacks without user interaction. Adobe says it is not aware of any active exploitation but assigned its highest deployment priority, urging admins to patch quickly, since ColdFusion has repeatedly been targeted by attackers and ransomware crews.
TrustStrike Labs