Topic

Vulnerability Management: news, advisories and analysis

10 articlesUpdated 6 Oct 2026

CyberSecureToday covers Vulnerability Management across 10 articles published between 10 Sep 2026 and 6 Oct 2026. The coverage includes 3 vulnerability advisories and 6 analysis or guidance pieces. 3 advisories are rated critical or high severity.

Stories on Vulnerability Management most often intersect with Active Exploitation, Patch Management and Edge Appliances, with Technology, Cloud & SaaS the most affected sector. The most recent story, “The Edge Appliance Vulnerability Treadmill: Why Network Gateways Remain Stuck in the C/C++ Memory Crisis”, was published 6 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

InsightsCloud & SaaS
The Edge Appliance Vulnerability Treadmill: Why Network Gateways Remain Stuck in the C/C++ Memory Crisis
Continuous zero-days in Citrix, Fortinet, and enterprise gateways demonstrate that reactive patching is failing. Only hardware MTE and Rust re-architectures offer an exit.
Mei-Lin Chen6 Oct 20268 min read
ResearchCloud & SaaS
Google GTIG: AI-Found Bugs Skew Toward Code Execution as Exploited Vulnerabilities Outpace All of 2025
GTIG's AI-era report: CVE disclosures doubled in 2026, 141 bugs exploited by August vs 127 in 2025, and 50% of AI-discovered flaws lead to RCE, per Google.
Priya Raman3 Oct 20267 min read
InsightsCloud & SaaS
OpenAI positions Daybreak as a governed loop for AI-assisted cyber defense
OpenAI says Daybreak combines models, Codex Security and human oversight into a governed loop for inventory, validation, remediation and proof.
Priya Raman12 Sep 20266 min read
InsightsGov & Defence
CISA BOD 26-04 ends CVSS-ordered patching: the four questions that replace it
CISA's Binding Operational Directive 26-04 drops CVSS from federal patch prioritisation, replacing it with four yes/no questions and a sixteen-row deadline table.
Priya Raman11 Sep 20267 min read
ThreatsIndustrial & OTCritical
SonicWall SMA1000 Zero-Day Chain Hit CISA KEV in Three Days. Patching Is the Easy Part
SonicWall disclosed two actively exploited SMA1000 flaws on 1 September; CISA set a 5 September federal deadline. The harder problem is proving an appliance you cannot instrument is clean.
Daniel Okafor11 Sep 20265 min read
NewsGov & Defence
A CVSS 10.0 ERP Flaw Your Scanner Will Never Report: The CERT-In Blind Spot
CERT-In scored an unauthenticated RCE in Manacle ERP at CVSS 10.0. The CVE is in NVD, but with no CPE data your scanner cannot match it. Here is how to fix that.
CST Editorial Desk11 Sep 20266 min read
ThreatsCloud & SaaSCritical
FortiClient EMS CVE-2026-35616: the hotfix window was not the dangerous part
Fortinet's emergency hotfix for CVE-2026-35616 blocked the attack path without fixing the flaw, and the complete patch that followed needed its own re-release.
Priya Raman10 Sep 20266 min read
ThreatsCloud & SaaSHigh
LiteLLM and Kestra in KEV: exploited AI tooling is now a vulnerability management problem
CISA added 15 CVEs to the KEV catalog in six working days, including exploited flaws in LiteLLM and Kestra — AI tooling that most asset inventories never see.
Daniel Okafor10 Sep 20266 min read
InsightsCloud & SaaS
SharePoint 2016/2019 is unpatchable now. Exchange has until 31 October.
SharePoint Server 2016 and 2019 lost support on 14 July 2026 with no paid ESU on offer. Exchange 2016/2019 has until 31 October. Here is how to contain both.
Priya Raman10 Sep 20266 min read
GuidesCloud & SaaS
Playbook: surviving a 900-CVE Patch Tuesday without breaking your change process
A repeatable triage model for very large monthly releases — what to expedite, what to schedule, and how to prove coverage afterwards.
Priya Raman10 Sep 20268 min read