Zscaler's 24 August 2026 CVE record describes multiple Client Connector flaws that allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context. Zscaler scored it 9.1 (CVSS 3.1). The CNA points administrators to the 2026 Client Connector app release summary for fixed builds. Affected version strings in that record include Windows before 4.6.0.457 / 4.7.0.317 / 4.8.0.232 / 4.9.0.372, macOS before 4.5.2.312 / 4.7.0.292 / 4.8.0.191, Linux before 3.7.2.64 / 4.2.1.64, Android and ChromeOS before 4.2, and iOS before 4.5.1. Confirm the exact build from the vendor release summary before declaring a fleet patched. Zscaler's CVE records (24 Aug 2026) also cover CVE-2026-59564 (authentication bypass in Client Connector to Portal communications), CVE-2026-59567 (local privilege escalation) and CVE-2026-59565 (buffer overflow causing local and kernel denial of service on Windows). Not in CISA KEV at last check.
Oracle Critical Patch Update (January 2026) lists CVE-2026-21962 in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS. Supported affected versions: 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. NVD rates CVSS 10.0. Unauthenticated network access via HTTP. Apply the January 2026 CPU for the plug-in builds you run.
Origin Energy confirmed unauthorised access to personal information of approximately 900,000 current and former customers in July 2026. Categories include name, address, date of birth, contact phone, account details, and partial payment data (last four digits of a credit card or last three of a bank account). On 21 August 2026 Origin said a completed review found about 60 customers had full bank account numbers accessed, about 100 had an ID document number accessed (number only, no scans), and about 15,000 had government concession-scheme numbers accessed. Origin told ABC the alleged attacker had not publicly leaked customer data. The company is working with ASD's ACSC, the National Office of Cyber Security, AFP and OAIC; a criminal investigation continues. Earlier reporting linked the incident to a former Accenture Manila call-centre worker; Accenture declined to comment to ABC. UPDATE (23 Oct 2026): AAP reports that at Origin's annual meeting on 14 October 2026 chairman Scott Perkins said: 'We have seen no evidence of the information being published on the internet or the dark web to date; however we note this risk remains and affected customers will need to remain vigilant to any suspicious activity or scams.' (source: AAP)
Unauthenticated OS command injection in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. NVD: crafted SMTP requests can run commands as the zimbra user. CERT Polska reported active exploitation. Patch to 10.1.20. UPDATE 30 Sep 2026: Microsoft Security Blog publishes tracking/hunting notes for unauthenticated command injection on internet-facing mail servers including this CVE. If you cannot upgrade, remove zimbra-snmp / disable snmp_notify and hunt per CERT Polska. UPDATE 1 Oct 2026: Microsoft Security Blog (30 Sep) details post-exploitation observed between patch availability (Zimbra 10.1.20, 20 Jul 2026) and public disclosure (13 Aug 2026) — including Jul 28–Aug 7 out-of-band probes via collaborator/OAST domains, JSP web shells across Jetty/mailboxd paths, wget/curl payload fetch, cron/systemd/memfd persistence, mailbox/authentication-data collection, and privilege escalation abusing Zimbra sudo-authorized helpers (zmmailboxdmgr writable log → PAM symlink → pam_exec → passwordless sudo for the zimbra account). THN 30 Sep reports the same Microsoft research. Cyberstack does not reproduce exploit construction. Hunt and contain per Microsoft + CERT Polska; patch remains 10.1.20; if upgrade delayed remove zimbra-snmp / disable snmp_notify.
Oz Hair and Beauty's official statement says its online purchase and order platform was briefly accessed by an unauthorised third party. Limited personal information of some customers who purchased before August 2026 was involved: full name, email and/or mobile, and purchase data (currency, total spend, purchase location, customer creation date). The company says credit cards, passwords, payment information and invoice details were not accessed. It reported the incident to ACSC, OAIC and New Zealand's Office of the Privacy Commissioner. Customers not emailed by 22 August 2026 were, on that statement, not identified as impacted on the investigation to date. The company has not published a count of affected records.
Kaspersky ICS CERT (KLCERT-26-057): an unauthenticated attacker with network access to TrueConf Server on TCP 4307 can call an undocumented function and run an arbitrary script. Affects 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and earlier than 5.3. NVD CVSS 9.8. Related CVE-2026-72530 is a code-injection issue in the same product line. Patch to the fixed builds and do not expose 4307 to the internet.
Cloud Software Group bulletin CTX696939 (19 August 2026, Critical) covers an authentication bypass using an alternate path in customer-managed NetScaler ADC and NetScaler Gateway. CVSS v4.0 9.3. It applies when the appliance is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server; on some later 14.1/13.1 builds only when a SAML action is also configured. Not Citrix-managed cloud. No workaround. Patch to 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 FIPS/NDcPP, as applicable. Secure Private Access Hybrid using customer-managed NetScaler also needs those builds. Updated 4 Sep 2026 (BleepingComputer, 4 September 11:25 pm Perth): BleepingComputer reports Previdian honeypot sensors saw requests matching a public PoC on 3 September from three source IPs geolocated to Australia, the United States and Germany — evidence of exploitation attempts, not confirmed successful compromise of production systems. The Centre for Cybersecurity Belgium also warned of exploitation attempts the same week. Citrix’s August bulletin had not yet flagged active exploitation. Updated 7 Sep 2026 (WA SOC): WA SOC advisory 20260907003 (7 September 2026, TLP:CLEAR) covers CVE-2026-19490 at CVSS 9.3 for the same build floors, and reports no exploitation on Western Australian Government networks at the time of writing. Updated 9 Sep 2026 (CISA): CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog on 9 September 2026 (due 12 September 2026 for FCEB under BOD 26-04, including forensic triage requirements). Patch floors unchanged: 14.1-73.32 / 13.1-63.21 and FIPS mates. Correction (26 Oct 2026): the BleepingComputer, WA SOC and CISA reports, all later than Citrix's 19 August bulletin, now carry Updated lines; the card date stays 19 August 2026. The WA SOC and CISA links now point to the addresses those pages have moved to. (source: Citrix; BleepingComputer; WA SOC; CISA)
Same CTX696939 bulletin: memory overflow that can cause unpredictable behaviour or denial of service when SIP ALG is enabled on a Large Scale NAT (LSN) group. CVSS v4.0 8.8. Customer-managed NetScaler ADC and Gateway only. No workaround. Same patched builds as CVE-2026-19490: 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 FIPS/NDcPP.
Quest Apartment Hotels (Ascott Australasia) identified the incident on 17 August 2026 after a website outage investigation showed a threat actor exploited a vulnerability in a third-party service provider and accessed Quest’s environment; Quest says the incident was contained and systems secured. Managing Director update (16 September 2026 PDF / update page) states forensic analysis found information relating to approximately 1,991,613 customers, all from records before June 2025. Beyond name/address/phone/email contact fields, Quest publishes category counts: vehicle registration 225,300; passport and/or driver licence number only (no scanned ID images) 104,268; credit card number without CVV (incl. expired) 297,739; credit card number with CVV (incl. expired) 46,727; date of birth 3,328; NDIS number 271; Medicare card number 46. Not every category applies to every person; Quest is notifying individuals in stages. Quest says it has notified and continues to cooperate with OAIC, ASD, ACSC and Victoria Police. Separate 23 September 2026 passport/licence clarification (company PDF): where an Australian passport number was affected, Quest cites Australian Passport Office advice that the passport remains safe to use for international travel (number alone cannot obtain a new passport; APO facial-recognition controls); where a driver licence number was affected, Quest says consider contacting the relevant state/territory roads authority. Updated customer FAQ PDF dated 23 September 2026. ABC News (22 September 2026 UTC) reported customer SMS/email notices and earlier advice that prompted some guests to reissue licences/cards; treat ABC as secondary to Quest’s own PDFs. (source: Quest /update hub) UPDATE (23 Oct 2026): Quest's update page links a 25 September 2026 scam alert saying customers have received unsolicited emails and WhatsApp messages impersonating Quest that ask them to confirm an upcoming booking by clicking a link; Quest says not to click the link or call the number in the message, and to contact the hotel directly using the details on the Quest website. The alert does not say whether these messages are connected to the data breach. (source: Quest (questapartments.com.au))
CVE-2026-18556 and CVE-2026-18577 are authentication-bypass issues in N-able N-central that may allow unauthorised access through an alternate path. ASD's ACSC has observed targeting of the product in Australia. Affects current versions including 2026.3. Vendor Hotfix 2 (build 2026.3.1.10, 6 August 2026) supersedes Hotfix 1. Review whether the console needs to face the internet.
CISA added CVE-2026-64849 to KEV on 19 August 2026. MLflow contains an SSRF issue that can let attackers reach internal or cloud metadata services. The CVE record states the issue is fixed in 3.15.0. Do not expose MLflow tracking servers to untrusted networks.
TP-Link security advisory FAQ 5248 (last updated 27 August 2026; firmware release noted by OPSWAT as 18 August 2026) covers CVE-2026-15315 and CVE-2026-15316 in Tapo smart cameras. CVE-2026-15315 (CVSS v4.0 8.7 High; CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N): improper authentication in the login verification module on Tapo C120 V1 and C200 V5 — a local-network attacker can replay device_confirm challenge material to obtain administrative session tokens without the camera password. CVE-2026-15316 (CVSS v4.0 7.1 High; CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N): oversized encrypted Wi-Fi credential input in C200 V5 onboarding crashes/restarts the HTTPS management service (DoS). Discovery credit: OPSWAT Unit 515 / fellowship research (Khoi Tran, Thai Do); OPSWAT blog notes further critical findings still under coordinated disclosure. Adjacent-network only (AV:A) — not internet-unauth without LAN/VPN reach to the camera. SecurityWeek 18 Sep roundup re-reported the advisory. (sources: TP-Link FAQ 5248; OPSWAT)
TP-Link — Security Advisory FAQ 5248 Tapo C120/C200 (updated 27 Aug 2026)
