RMM Zero-Day, a Record Patch Tuesday and the First Shared AI-Built Exploit Kit

RMM Zero-Day, a Record Patch Tuesday and the First Shared AI-Built Exploit Kit

Week of 14 September 2026 | Compiled by Team Paringa

The week the management plane became the target: remote monitoring tools, update stacks and VPN gateways all went from advisory to active exploitation in under 72 hours, and attackers are now using AI to compress the time from disclosure to domain admin.

What Happened This Week

🔴 N-able N-central zero-day headlines a week of 14 new exploited CVEs, all in the management plane

N-able confirmed on 5 September that CVE-2026-86218, a CVSS 10.0 static code injection flaw in its N-central remote monitoring and management (RMM) platform, was being exploited as a zero-day. The bug allows unauthenticated remote code execution on any exposed on-premises N-central server. Huntress observed attacks against N-central's API and appliance logs from 4 September and warned that limited logging on the appliance meant it could not determine which of three recent N-central flaws (CVE-2026-86206, CVE-2026-86207 and now CVE-2026-86218) the attackers used to get in. N-able's own advisory tells customers to hunt for scanning from 23.234.64.0/18 and for user accounts they do not recognise. It is N-able's third N-central zero-day in six weeks.

The N-central case is one data point in a much larger pattern. CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities catalogue in the seven days to 12 September, across 11 vendors: ConnectWise ScreenConnect (CVE-2026-84869, CVSS 9.9), GitLab (CVE-2026-85706, CVSS 10.0, exploited one day after disclosure), Citrix NetScaler (CVE-2026-19490), Cisco Firewall Management Center (CVE-2026-20079, CVSS 10.0, 76% EPSS), two MikroTik RouterOS bugs, two JFrog Artifactory bugs chained to deploy backdoors, Fortinet, Adobe Commerce and the two Microsoft zero-days. That is 44 new KEV entries in 30 days.

Every one of those products sits in the management or trust layer: RMM, remote access, source control, artifact repositories, firewalls, load balancers, routers. Compromise one and you inherit its downstream reach. For an MSP running N-central, a single exposed server is simultaneous access to every client tenant under management. The Dutch NCSC added to the pressure on 12 September, warning that two critical Check Point VPN gateway flaws patched on 9 September (CVE-2026-85102 and CVE-2026-85103, both remote code execution on Security Gateways) are expected to be exploited imminently, and advising site-to-site VPN users to restrict rules to trusted IPs now rather than wait for a proof of concept.

Sources: SecurityWeek, Help Net Security, Senserva KEV tracker, BleepingComputer

The question for a UK or European CISO this week is not "have we patched N-central" but "who is watching the management plane between the advisory and the patch window". Huntress caught N-central exploitation on 4 September because it was already inspecting appliance API logs; N-able's own guidance is to go looking for unrecognised accounts after the fact. Fourteen KEV additions in a week is beyond what an internal team can triage while also running a 966-CVE Patch Tuesday. This is the case for a managed detection layer that treats RMM, VPN and identity infrastructure as tier-one assets with their own detections, which is what vCyberiz's Cyber Fusion Centre does through the Risk, Cloud and Threat domains of the DIRECT framework. If your MSP or internal team cannot tell you in one hour which of these 14 CVEs touch your estate and whether any have been probed, that is the gap to close.

🟡 Record Patch Tuesday lands as the BlueMoon exploit kit chains a Windows zero-day with two Chrome zero-days

Microsoft's 8 September Patch Tuesday fixed between 964 and 974 vulnerabilities depending on who counted (BleepingComputer 966, Microsoft 974, Talos 973), up more than 200 on August's 751. Talos rated 113 as critical, 82 of them remote code execution. Two were exploited before patches shipped and went into CISA's KEV catalogue the same day: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC. Both are elevation-of-privilege bugs, CVSS 7.8, rated only "Important", and both hand SYSTEM to an attacker who already has a foothold. A CVSS 9.8 Windows DNS Server RCE (CVE-2026-69730) also shipped without confirmed exploitation. The update also broke Remote Desktop Services on some Windows Server builds, complicating rollout.

The ALPC bug did not stay isolated. Proofpoint reported on 12 September that an exploit kit it calls BlueMoon chains two Chrome V8 zero-days (CVE-2026-85046, patched 3 September, and CVE-2026-87491, patched 8 September) with CVE-2026-85880 to escape the browser sandbox, escalate to SYSTEM and pull a payload via curl. China-linked Violet Typhoon (APT31) used it first on 28 August against US NGOs, mining and commodity trading firms. Within days three further Chinese clusters were using it against US aerospace, a Vietnamese manufacturer and government, consulting and financial targets in Indonesia and Singapore. Proofpoint does not know how the kit spread between actors, notes development artefacts suggesting AI-assisted construction, and expects financially motivated groups to pick it up next.

Sources: SecurityWeek, BleepingComputer, Tech Insider

A browser-to-SYSTEM chain built from three zero-days in under two weeks, shared across four espionage groups within days, is a new tempo. The defensive lesson is that patch volume is now the wrong metric: two 7.8-rated bugs mattered more than 80 critical ones. Push KEV-listed fixes inside 48 hours regardless of where you are in the wider rollout, and make sure endpoint telemetry can see the specific BlueMoon signals (Chrome broker process injection, curl spawned from a browser parent). vRespond+ MDR customers get that detection content pushed rather than built; everyone else should be checking whether their EDR vendor has it yet.

🟡 AI-orchestrated PaperCut campaign hits 440 deployments in 48 countries, domain admin in minutes

GreyNoise reported on 10 September that a Russian-speaking actor used AI to build, test and deploy exploits for two PaperCut NG/MF authentication bypass flaws (CVE-2026-82078 and CVE-2026-81578, disclosed 27 August, patched the next day) against 440 deployments at 395 organisations in 48 countries. The AI orchestration compressed some intrusions to minutes or seconds. The actor harvested LSASS memory and registry secrets from 280 hosts, exfiltrated credentials from 137, ran NoPac against unpatched domain controllers and added itself to Domain Admins on 12 victims. Education accounted for 204 of the 440 compromised deployments, with IT/MSP, manufacturing, utilities and professional services also hit. GreyNoise believes the actor may be developing access to hand to ransomware affiliates.

This is not the first automated campaign of 2026 (Black Kite's annual report documented JADEPUFFER, an AI agent running reconnaissance through encryption with minimal human direction), but it is the largest with a full victim count and a clear failure of the actor's own targeting controls: it tried to exclude 28 countries and hit some of them anyway.

Sources: SecurityWeek, Black Kite

The gap between patch release and mass exploitation for PaperCut was measured in days, and the gap between initial access and domain admin was measured in minutes. Neither timeline fits a monthly patch cycle or a business-hours SOC. Print servers, like RMM and VPN, are exactly the unglamorous domain-joined assets that never make the crown-jewels list but sit one hop from the domain controller. The practical fix is continuous exposure scanning tied to a response team that can isolate a host at 03:00, plus credential hygiene that means one harvested LSASS dump does not become domain admin. That is Endpoint and Identity in the DIRECT model, run as a service.

What CISOs and Heads of Security Operations Are Dealing With

The pattern this week is a shift in where the attacker's effort goes. Three of the four lead stories are about infrastructure that manages other infrastructure: an RMM platform, the Windows update stack, VPN gateways and a print server that happens to be domain-joined. Attackers have worked out that compromising the management plane is cheaper and gives more reach than attacking applications one by one, and CISA's 44 KEV additions in 30 days reflect that. At the same time, AI is compressing both exploit development (BlueMoon, PaperCut) and post-exploitation (domain admin in minutes), so the window between disclosure and damage is shorter than most patch SLAs.

The consequence for security operations is that detection-and-response speed, not patch completeness, now determines outcomes. The organisations that came through this week well were the ones with someone already reading N-central API logs on 4 September, or with endpoint telemetry that flagged curl spawning from Chrome. For most mid-market UK and European organisations that capability does not exist in-house at the hours attackers keep, which is why managed detection is moving from a nice-to-have to the control that everything else depends on.

Three Things Worth Watching Next Week

1. Check Point VPN exploitation - The Dutch NCSC expects attacks on CVE-2026-85102/85103 imminently. If your gateway is on R81.20, R82 or R82.10, confirm LivePatch Take 24 applied; if you are on an end-of-support release, you are exposed with no fix.

2. BlueMoon moving to criminal actors - Proofpoint expects the kit to reach financially motivated groups. Watch for it appearing in ransomware initial-access chains and check EDR vendors for coverage of the Chrome broker injection technique.

3. The Veradigm leak deadline - The Gentlemen's 11 September deadline for 3.5 million patient records has passed. Veradigm's SEC filing confirmed the entry point was a vendor's API credential. Expect the leak, and expect the same vendor-credential vector in other healthcare and supply-chain disclosures.

Questions? hello@paringa.ai

Paringa delivers managed detection and response through vCyberiz's Cyber Fusion Centre, structured around the DIRECT framework, for organisations that need 24/7 response speed without building a SOC. We start with the management plane, because that is where this week's attackers started. | 14 September 2026 | © Paringa Ltd