Tuesday, September 1, 2026

Azure SQL Managed Instance Elevation of Privilege — CVE-2026-62836 (CVSS 8.7) Patched in August 2026 Patch Tuesday

CVE-2026-62836 is a Critical elevation-of-privilege vulnerability in Azure SQL Managed Instance with a CVSS score of 8.7, patched as part of Microsoft's August 2026 Patch Tuesday release. Azure SQL Managed Instance runs on Azure infrastructure and is widely used by enterprise MSP clients. Apply the August 2026 cumulative update immediately; no workaround is available for this cloud-managed service.

Exchange Server Privilege Escalation CVE-2026-62911 Flagged as Priority in August Patch Tuesday

CVE-2026-62911, an elevation-of-privilege vulnerability in Exchange Server, was flagged by Zero Day Initiative's Dustin Childs as a priority patch in August 2026 Patch Tuesday. Exchange Server remains a high-value target for threat actors, and EoP flaws are frequently chained with other vulnerabilities for full compromise. Apply August 2026 Exchange Server updates without delay; review Exchange permission configurations and audit privileged account activity.

PAN-OS GlobalProtect Auth Bypass CVE-2026-0257 — Active Exploitation Confirmed, CISA KEV Listed

Palo Alto Networks confirmed active exploitation of CVE-2026-0257 (CVSSv4 7.8), a critical authentication bypass in PAN-OS GlobalProtect portal and gateway components, with exploitation beginning just four days after disclosure in May 2026. CISA added it to the Known Exploited Vulnerabilities catalog on 29 May 2026, and Rapid7 has published public proof-of-concept code, significantly lowering the barrier for exploitation. Patch immediately to the fixed PAN-OS version; as a workaround, detect exploitation by identifying 'Cookie' authentication method in logs from suspicious hosting-provider source IPs.

Palo Alto and SonicWall Publish New High-Severity Firewall Security Updates — Immediate Patching Urged

Both Palo Alto Networks and SonicWall published new coordinated security advisories covering high-severity vulnerabilities across supported firewall and VPN platforms, including flaws that could enable denial of service, policy bypass, or privilege escalation. Vendors urge customers to update internet-facing firewalls and VPN gateways immediately. Where patching cannot be completed immediately, apply vendor-recommended mitigations and restrict management interfaces to trusted IP ranges.

Kaseya Data: AI Automation Cutting MSP First-Response Times for 35% of Providers

Kaseya's 2026 research found that 59% of MSPs expect AI to eliminate tedious tasks and 44% expect it to free up time for strategic work, with automation already improving first-response times for 35% of providers and technician efficiency for 32%. The talent gap has overtaken tooling as the MSP industry's primary operational constraint, with difficulty hiring skilled technicians jumping from 9% to 16% year-over-year. The practical takeaway: AI's primary value for MSPs in 2026 is scaling output without scaling headcount at the same pace.

CRN Xchange Australia Launches 16 September 2026 in Sydney — Premier MSP/Channel Event

CRN Australia's inaugural Xchange Australia conference is set for 16 September 2026 at the Intercontinental Sydney, targeting MSPs, IT solution providers, system integrators, and resellers with keynotes, panels, and boardroom sessions focused on AI, cybersecurity, and channel growth. The Channel Awards follow the next day on 17 September at the Hyatt Regency Sydney, with finalists already announced across partner, vendor, and distributor categories. Australian MSPs seeking peer networking, vendor engagement, and strategic insight should prioritise attendance at both events.

Coastal Cyber Launches in Australia to Help MSPs Build Repeatable GRC and Security Frameworks for SME Clients

Coastal Cyber, a new Australian cybersecurity advisory practice founded by Daniel Johns (formerly MyCISO, CyberCX, ASI Solutions), has launched to provide MSPs and resellers with independent guidance on governance, risk, and compliance (GRC), risk management, and security posture. The practice targets mid-market organisations across financial services, healthcare, and technology via the channel, addressing a gap Johns identified through ISACA and CompTIA networks where MSPs struggle to connect governance, technical controls, and business risk for clients. For MSPs looking to expand their GRC service offering, Coastal Cyber represents a potential white-label or referral partner in the Australian market.

CRN Xchange Australia and Channel Awards Coming to Sydney — 16–17 September 2026

CRN Australia's inaugural Xchange Australia conference will be held on 16 September 2026 at the Intercontinental Sydney, followed by the inaugural CRN Channel Awards on 17 September at the Hyatt Regency Sydney. The events are positioned as the premier gathering for Australian MSPs, solution providers, and channel partners, with AI, cybersecurity, and business strategy as key themes. MSPs and vendors should register now — the events are less than three weeks away.