⚡ THE ONE THING TODAY
Scan your entire customer base for N-able N-central instances with CVE-2026-18556 or CVE-2026-18577 and start phased patching — this one is actively being exploited.
Microsoft Shifts Copilot Business Licenses to Usage-Based Billing Model
Microsoft has announced a shift in how Copilot Business licenses are billed, moving from a flat per-user subscription to a usage-based model — a significant change for MSPs who resell or manage Copilot at scale. Partners should review client agreements and adjust billing and forecasting processes accordingly. No workaround required, but MSPs should communicate the change to clients ahead of renewal cycles.
APT28 Exploiting Windows CVEs CVE-2026-21509 and CVE-2026-32202 in Email Campaigns
Proofpoint researchers report that APT28 (TA422) exploited CVE-2026-21509 and CVE-2026-32202 — both Microsoft Office/Windows ecosystem vulnerabilities — within days of disclosure in targeted email campaigns. CVE-2026-32202 is an incomplete patch bypass for an earlier flaw, making it particularly dangerous for organisations that applied the original fix. MSPs should ensure clients have the latest Microsoft Office and Windows patches deployed urgently.
September 2026 Patch Tuesday Zero-Days Still Unpatched on Many Systems
Two actively exploited zero-days from September's Patch Tuesday — CVE-2026-81963 (Windows Update Stack Elevation of Privilege) and CVE-2026-85880 (Advanced Local Procedure Call Elevation of Privilege) — were confirmed exploited in the wild last month and may still be unpatched across client endpoints. With the October Patch Tuesday imminent, MSPs should treat any outstanding September updates as urgent before the 13 October release adds to the queue. No workaround exists; patching is the only remediation.
SonicWall SMA1000 High-Severity SQL Injection CVE-2026-4112 Patched
SonicWall released patches for CVE-2026-4112, a high-severity SQL injection flaw in SMA1000 series firewalls that could allow attackers with read-only admin privileges to escalate to primary admin rights. Three additional vulnerabilities in the same release could allow remote attackers to enumerate SSL VPN user credentials or bypass TOTP authentication. SonicWall reports no confirmed exploitation but urges immediate update of SMA1000 appliances; check psirt.sonicwall.com for firmware guidance.
ACSC Confirms Active Exploitation of N-able N-central RMM in Australia (CVE-2026-18556 & CVE-2026-18577)
The Australian Cyber Security Centre (ACSC) issued a high-priority alert in August 2026 warning of active in-Australia exploitation of two authentication bypass vulnerabilities (CVE-2026-18556 and CVE-2026-18577, both CVSS 8.2) in the N-able N-central RMM platform. Attackers can gain unauthorised access without credentials, potentially compromising entire MSP-managed client estates. MSPs using N-central should apply patches immediately and audit access logs; the ACSC explicitly advised SMBs to ask their MSP whether they use the product.
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.