Which Zero-Day Actually Matters?

# Which Zero-Day Actually Matters? The industry has an obsession with the word "critical" that's made it useless, and every vendor wants their advisory to scream from the rooftops (usually because they found a flaw that might lead to remote code execution). There's a catch. A dozen specific conditions have to be met and the attacker needs a lot of patience. I don't care about theoretical severity. I care about who is actually knocking on the door. If you're staring at your dashboard this afternoon, start with N-able. Three new CVEs hit today: CVE-2026-86218, CVE-2026-86206, and CVE-2026-86207. They're zero-days in N-central. You aren't just patching a server here; you're securing the keys to every endpoint an MSP manages; that is where the risk lives. One compromised N-able console turns a security provider into a ransomware delivery vehicle for hundreds of clients at once. If you run N-central, don't wait for the next window. Do it now. Check the edges. CISA added several entries to the Known Exploited Vulnerabilities list on September 2; federal agencies had until September 5 to fix most of them. Government shops are already late. Private sector firms are just mirroring that failure. SonicWall SMA1000 appliances are the target this time. CVE-2026-83548 is an SSRF and CVE-2026-83549 is an OS command injection. These devices live on the perimeter. An OS command injection on a gateway isn't a risk, it's an invitation; sangoma Switchvox users have their own problem with CVE-2026-9586. It's a SQL injection. Four separate reports came in this week. Why would attackers stop at the voicemail once they pivot from the phone system into the network? Then there is Google Chrome. CVE-2026-85046 marks the sixth Chrome zero-day of 2026, and CISA put it on the KEV list on September 4 and set a deadline for September 18. Auto-updates handle most people, but manual versioning in locked-down environments makes this the priority. Type confusion in V8 is a classic way to get initial access. Now, let's talk about what can wait. There is plenty of noise about CVE-2026-59346 in VMware Workstation and Fusion. It lets a VM admin run code on the host; this isn't an emergency unless you are running an untrusted guest OS with administrative privileges on your main workstation, which is its own kind of failure. The Cisco Nexus 9000 flaw (CVE-2026-20212) is similar, and unauthenticated attackers can run code as root. But the attacker has to be inside your network unless you've exposed your management plane to the public internet by mistake, and if they are already in your core switching fabric, a single Cisco patch won't save you. Some say every critical flaw must be patched immediately for compliance; compliance is a checkbox for auditors. Security is about survival. Patching a local VMware bug while an N-able console or SonicWall gateway stays exposed isn't following protocol. It's performance art. We've seen this before. In 2023, companies prioritized internal server patches and ignored edge VPNs. Then they wondered why attackers were already in the domain controller. The parallel is exact. We look at vendor severity scores instead of whether an asset can actually be reached. Who can see this port from a coffee shop in another country? That's the only question that matters. If the answer is everyone, stop reading and update your firmware.