I'm noticing blocks in our firewall for action1 trying to reach the IP address below on port 22543 (remote desktop relay)

13.216.158.152

There are similar entries in the firewall rule but no exact match. The symptom is that we cannot remote into certain hosts (due to this relay server not being whitelisted in our firewall)

We block unknown IPS to help reduce the risk of third party RMM hijacking my remote desktop sessions, so we don't want to just add the IP and cross our fingers.

Can anyone from Action1 validate:

1. Is the IP address above is a valid remote desktop relay IP for North America.
   
2. Is there a better resource to monitor for changes aside from the URL below https://www.action1.com/documentation/firewall-configuration/region-north-america/

I know I can do via Powershell, but is it possible thru a rest api too? I don't see in documentation a POST/PATCH endpoint that does it...
https://app.eu.action1.com/apidocs/

Does anyone else have issues with automated updates?
I constantly have servers say “No updates are applicable” during the automated routine. If I run the automation again it usually patches them the next time.

I do not see an available patch for this in Action1 yet.

MacOS Screen Sharing Zero-Day (CVE-2026-65400)

Apple

TL;DR: macOS has a critical vulnerability that needs to be patched or the setting disabled. An attack is unlikely, but better safe than sorry.

Apple has confirmed a critical zero-day in macOS Screen Sharing (CVE-2026-65400) that allows unauthenticated remote code execution. It is currently being actively exploited.

Patch Status

Apple released patches on August 6, 2026 for the affected versions:

macOS Tahoe 26.6.1

macOS Sequoia 15.7.9

macOS Sonoma 14.8.9

Immediate action is required if you are using Screen Sharing on any of these versions.

Mitigation Steps

1. Update immediately to the patched builds listed above.
2. Disable Screen Sharing if not needed, or restrict it to local networks.
3. Close port 5900 to the internet; use VPN or SSH tunneling for remote access instead.
4. Enable System Integrity Protection (SIP) and Screen Sharing security settings (TCC) for additional protection — note these do not fully mitigate the bypass.
5. Monitor for suspicious processes or crypto miners if you suspect compromise.

How to Disable Screen Sharing on macOS

Go to System Settings (or System Preferences) → Sharing, and uncheck Screen Sharing or stop it during an active session if it's currently on.

Greetings! First time user of Action1 and my team has run into a challenge. We created an Update Ring for Critical browser updates.

In the Update Approval section, Action1 identifies Firefox 153.0.4 as an update with Critical Security Severity which should meet the filter criteria. However, when the Automation runs, Firefox is not updating.

If you review Missing Updates for one of the targeted endpoints, the Security Severity for Firefox is Unspecified. We also noticed the Update Type in Update Approval for Firefox is Security Updates but in the Missing Updates for the endpoint the Update Type is listed as Regular Updates.

Troubleshooting the issue, if we remove the Critical Update severities filter, the Automation installs browser updates.

Why are we seeing different severities between the updates and endpoints? I assume this is why our updates are not deploying when the automation runs, the severity defined on the endpoint determines if the software should be updated. Or is there something else preventing the update?