Topic
A class of security vulnerabilities and techniques that let an attacker with limited system access gain higher-level permissions, such as root or admin control.
Calif published a working exploit that gets root on OpenBSD 7.9 past KARL, SMAP and SMEP by chaining two flaws patched on September 14 and 30. Neither flaw has a CVE, and The Hacker News reports no evidence of attacks.
Reality
Nix and Lix jointly disclosed daemon flaws on October 13 that chain into local root, and each project shipped a fixed release that day. Multi-user installs where untrusted users can reach the daemon should upgrade now, Tech AI Wire reports.
Reality
Microsoft issued an out-of-band Exchange Server fix for CVE-2026-96940, a bug letting signed-in attackers read colleagues' mail and attachments. The company expects the flaw to be consistently exploitable, so on-premises admins have good reason to install it ahead of the next maintenance window.
Perspective Coverage
3 publishersReality
CVE-2026-67401 lets an ordinary cPanel mail account escalate to root through a SQL injection in the EmailTrack delivery-log feature. cPanel disclosed the vulnerability class but has not published the vulnerable parameter or the query behind it.
Reality
ABB's PCM600 IED manager, versions 2.14 and earlier, lets a standard local user take control of the host through a Scheduler Service running as LocalSystem. ABB's remedy is a workaround it says reduces the risk without correcting the underlying flaw.
Reality
DIVD said attackers chained two Zammad zero-days on its own internet-facing server and went from a hijacked session to root in seconds. It assessed that an AI agent was involved and says upgrading to version 7 is not a complete fix for both flaws.
Reality
Microsoft's record September release fixed up to 997 CVEs, including two local escalations to SYSTEM that attackers used before the patch shipped. A 7.8 score understates the step that turns a phishing foothold into control of the machine, so both go ahead of the 9.8 remote flaws.
Reality
Copy Fail, tracked as CVE-2026-31431, lets any unprivileged local user write a chosen four bytes into the page cache of any readable file. Because it fires every time the right syscalls run in order, timing-based mitigations do not apply.
Reality
CVE-2026-86060, the privilege half of the MikroTrick chain CERT Polska analysed, lets an SSH client set its own policy mask and take RouterOS full-group admin. The September 2026 releases fix it, and a scan found 9,559 devices reachable over SSH.
Reality
CVE-2026-81963 in the Update Stack and CVE-2026-85880 in ALPC each take a low-privilege foothold to SYSTEM, and the remediation guidance asks for verified restarts, which is a harder number to report than install counts.
Reality
cPanel's September 14 advisory covers every LiteSpeed Web Server Enterprise build before 6.3.7. The fix shipped on September 11; because auto-update may lag, administrators have to force it onto servers by hand.
Reality
Researcher Rasmus Moorats published a two-flaw root chain for the OnePlus 15 on September 24, 127 days after OnePlus confirmed it and with no fix shipped. Until a patch lands, owners of affected OnePlus and OPPO phones can defend only by keeping untrusted apps off them.
Reality
A dev.to walkthrough pins the first pass of a least-privilege review on four questions the API server already answers, and it puts create pods above get secrets in the escalation order. Aggregated roles decide how far that pass gets.
Reality
Veeam Agent for Windows has a local flaw that promotes a standard account to SYSTEM. Exploit code has been public since September 14. Arctic Wolf says there is no official workaround for systems that cannot patch yet.
Reality
The three kernel CVEs CISA added to its exploited-bugs catalog on Friday all need local access, and the lowest-scored of them is the one STAR Labs used for privilege escalation and container escape. Red Hat has confirmed public exploit code.
Perspective Coverage
6 publishersReality
A researcher posting to oss-security reports that all four proof-of-concept exploits gave an unprivileged local user root code execution on the test targets, against kernel code that has been in the tree for between 10 and 21 years.
Reality
CVE-2026-76461 is one of three flaws confirmed under active attack in a single week. Revolut's customer records left by a different route, a request sent from an email address on a government agency's own domain.
Reality
Two RouterOS flaws published to NVD on 2026-09-05 both sit in code that runs before a session has proven who it is. An upgrade closes them. Which management services answer from the internet is still an open question.
Reality
CVE-2026-85889 let an unauthorized attacker elevate privileges over the network in the platform enterprises use to run generative AI agents. Microsoft says the fix is already live and there is nothing for customers to install.
Reality
The bugs sit in 14 named Azure and Copilot services and Microsoft rated all 18 critical, but the fixes were already running in production when the disclosure went out, so tenants cannot install or verify anything themselves.
Reality
Security · September 16, 2026 · Confirmed4 publishers
Security · September 10, 2026 · Confirmed2 publishers