Apple Releases macOS Tahoe 26.6.2 Fixing 28 Vulnerabilities Including Kernel Flaws
Apple has released macOS Tahoe 26.6.2 for Mac systems on August 17, 2026, local time. The update resolves 28 vulnerabilities tracked by CVE identifiers and includes corresponding Safari updates for older operating systems.
The patch set covers three kernel vulnerabilities. These include the Use After Free issue CVE-2026-65343, the out-of-bounds memory read CVE-2026-65349, and the memory corruption flaw CVE-2026-65330. Twenty-one additional vulnerabilities affect the WebKit rendering engine, while further fixes address components such as Audio, ImageIO, and IOGPUFamily.
The corrections in macOS Tahoe 26.6.2 reflect changes that were first made available in the macOS Golden Gate 27 beta. On August 18, Apple released Safari 26.6.1 for macOS Sonoma and macOS Sequoia, resolving the same 21 WebKit vulnerabilities.
The complete list of addressed CVEs is as follows:
- CVE-2026-43794
- CVE-2026-43795
- CVE-2026-64715
- CVE-2026-64778
- CVE-2026-64779
- CVE-2026-64780
- CVE-2026-64781
- CVE-2026-64782
- CVE-2026-64784
- CVE-2026-64787
- CVE-2026-64788
- CVE-2026-65330
- CVE-2026-65331
- CVE-2026-65332
- CVE-2026-65333
- CVE-2026-65334
- CVE-2026-65335
- CVE-2026-65336
- CVE-2026-65337
- CVE-2026-65338
- CVE-2026-65339
- CVE-2026-65340
- CVE-2026-65341
- CVE-2026-65343
- CVE-2026-65346
- CVE-2026-65347
- CVE-2026-65349
- CVE-2026-65351
Related articles
Critical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited
Adobe has released an emergency security update for Adobe Commerce and Magento after discovering a critical zero-day vulnerability that permits remote attackers to execute arbitrary code without authentication. The flaw, tracked as CVE-2026-75650, stems from improper sanitization of special elements in the template engine and carries the maximum CVSSv3.1 base score of 10.0. Adobe rates the issue as Critical and confirms active exploitation in real-world attacks. A hotfix is now available, and the company has assigned the highest priority rating of 1, urging all customers to apply the update within 72 hours. The advisory was published on September 7, 2026, highlighting the need for immediate action due to the severity and confirmed abuse.
Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access
A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.
SCCM Misconfigurations Expose Organizations to Full Infrastructure Takeover
BI.ZONE expert Alexander Kuznetsov details how Microsoft Configuration Manager (SCCM) deployments in 25% of Russian organizations can grant attackers complete control over corporate infrastructure when misconfigured. The article outlines critical risks including administrative privilege escalation, lateral movement, data collection, persistence, and policy manipulation that allow attackers to blend with legitimate maintenance operations. Key recommendations focus on infrastructure isolation, placing Site Server, SMS Provider, and Site Database Server roles in Tier 0 segments, and avoiding single SCCM hierarchies across multiple Active Directory forests or security tiers. The report emphasizes eliminating Network Access Account (NAA) usage in favor of HTTPS or Enhanced HTTP, strictly limiting Client Push Account and domain join account privileges, and auditing computer accounts for site servers. Additional guidance covers PXE deployment risks, database access restrictions, and role-based administrative controls to prevent credential extraction via tools such as SharpSCCM and mimikatz. Overall, the publication provides actionable hardening steps aligned with the principle of least privilege to reduce the attack surface of widely deployed SCCM environments.
Critical Vulnerability in ASUS Control Center Enterprise Allows Remote Root Access Without Authentication
ASUS has disclosed a severe vulnerability in its terminal management software ASUS Control Center Enterprise (ACC) that could allow unauthenticated remote attackers to obtain root privileges. The issue, tracked as CVE-2026-75754, stems from a combination of hardcoded credentials, missing authentication on critical functions, and server-side request forgery flaws. Attackers can retrieve encryption keys via unauthenticated HTTP requests and then enable SSH on TCP port 2222 using the hardcoded credentials to log in as root. The flaw affects managed devices across an organization, potentially leading to data leakage, tampering, deletion, and full remote control. ASUS released a security advisory on September 4, 2026, and strongly recommends immediate updates. The vulnerability was reported by Security NEXT on September 7, 2026.