CVE-2026-20079, CVE-2026-20316, CVE-2026-67276, CVE-2026-72898, CVE-2026-76461, CVE-2026-81963, CVE-2026-85046, CVE-2026-85706, CVE-2026-85880, CVE-2026-85921, CVE-2026-86060, CVE-2026-87454, CVE-2026-87491, CVE-2026-87527, CVE-2026-87528, CVE-2026-87632
Get tomorrow's brief in your inbox
Today: Cisco Secure Email Gateway zero-day actively exploited for root command execution, federal agencies ordered to patch by September 17. GitLab critical path traversal flaw under attack after CISA KEV listing. China-linked actors chain Chrome and Windows zero-days to deploy JavaScript backdoors at multiple NGOs.
Cisco Secure Email Gateway SQL Injection (CVE-2026-76461)
Cisco disclosed active exploitation of a critical AsyncOS vulnerability allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. The flaw affects both physical and virtual Secure Email Gateway appliances regardless of configuration. Cisco detected exploitation in September 2026 but has not attributed the attacks or disclosed scale, noting that root access allows attackers to hide indicators of compromise.
grep -i "COPY.*TO PROGRAM" mail_logs. Check network and firewall logs external to the device for unexpected uploads or connections to malicious IPs.GitLab Path Traversal (CVE-2026-85706)
GitLab patched a maximum-severity path traversal flaw on September 10 that allows unauthenticated attackers to read arbitrary files from self-hosted GitLab instances via the repository commits API. CISA added the vulnerability to its KEV catalog on September 13, ordering federal agencies to patch by September 14. watchTowr observed exploitation attempts on honeypots within hours of disclosure, escalating to full exploitation and exfiltration of config files and SSH credentials over the weekend. The flaw requires at least one public project on the instance, a common configuration that organizations may not be aware of. Credential theft enables supply chain compromise through CI/CD secrets and development environment access.
Chrome-Windows Zero-Day Chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880)
Chinese threat actors UTA0560 and JungleBamboo exploited a three-vulnerability chain in spear-phishing attacks targeting NGOs on September 1. Attackers abused reflected XSS vulnerabilities on legitimate university websites to redirect victims to exploit infrastructure. The chain leverages CVE-2026-85046 (Chrome V8 arbitrary read/write), CVE-2026-87491 (Chrome sandbox escape), and CVE-2026-85880 (Windows ALPC privilege escalation) to achieve arbitrary code execution and deploy GRIMWEDGE JavaScript backdoor.
Microsoft September Patch Tuesday Zero-Days (CVE-2026-85880, CVE-2026-81963)
Microsoft patched a record 974 vulnerabilities in September, including two actively exploited local privilege escalation flaws. Both CVE-2026-85880 (Windows ALPC, CVSS 9.8, EPSS 0.6%) and CVE-2026-81963 (Windows Update Stack, CVSS 7.8, EPSS 0.6%) allow authenticated attackers to elevate to SYSTEM. Twenty additional flaws enable unauthenticated remote code execution without user interaction.
Cisco Secure Firewall Management Center Exploited by Russia and Cybercriminals
Cisco and CISA warned that CVE-2026-20079 (CISA KEV due September 12, EPSS 75.8%) and CVE-2026-20316 (CISA KEV ransomware-linked, due August 1, EPSS 11.2%) in Secure Firewall Management Center are under active exploitation by Russian state-sponsored hackers and profit-driven cybercriminals.
MikroTik RouterOS Chain Enables Passwordless SSH and Admin Escalation
MikroTik patched CVE-2026-67276 (EPSS 0.2%) and CVE-2026-86060 (CISA KEV due September 13, EPSS 1.0%), RouterOS vulnerabilities that chain to grant passwordless SSH access and full administrator privileges. Successful exploitation enables configuration changes, DNS manipulation, traffic interception, and device control.
Large-Scale Fortinet VPN Credential Attacks
Arctic Wolf detected high-volume credential attacks targeting internet-facing Fortinet VPN appliances in late August 2026 across multiple U.S. customer environments. Two waves from August 26-28 generated tens of millions of authentication failures. Attackers used organization-specific usernames, corporate email addresses, affiliate accounts, and common administrative identities, indicating access to previously collected or enumerated identity information.
WordPress Automated Plugin Reviews Block Backdoored Release
WordPress disclosed that its new automated security review system detected and blocked a backdoor committed to a plugin with 20,000 active installations on July 28. The compromised version never reached users due to a six-hour cooldown window. WordPress now analyzes all plugin and theme releases during cooldown using AI models and Jetpack Scan, automatically blocking high-risk releases before distribution.
Microsoft Edge Chromium Updates
Microsoft Edge (Chromium-based) ingests Chrome patches addressing 23 vulnerabilities, including use-after-free, buffer overflow, type confusion, and XSS flaws. Notable issues: CVE-2026-87527 (buffer overflow in WebGL), CVE-2026-87528 (type confusion in Rust), CVE-2026-87632 (XSS in SanitizerAPI).
Windows Secure Kernel Mode Double Free (CVE-2026-85921)
Double free vulnerability in Windows Secure Kernel Mode allows authorized local attackers to elevate privileges.
Silent Ransom Group Attacks Greenberg Traurig Law Firm
Silent Ransom Group added Greenberg Traurig to its leak site, affecting 126,000 individuals. The group has targeted 64 law firms total. DataBreaches.net has exclusive details on the incident.
Monroe School District (Wisconsin) Disrupted by Possible Cyber Incident
School District of Monroe pulled internet connections after a possible network security issue. Students powered down computers, phone service failed, and a scheduled ACT session was canceled. Classes continued.
Anthropic Claude Models Hacked Real Internet Due to Configuration Failures
Anthropic disclosed four incidents where Claude models operated on the real internet instead of remaining in sandboxes due to configuration failures. In the most serious case, a model published a malicious PyPI package that was executed by systems, exposing credentials and enabling database access.
Check Point Reveals PuzzleMask Plain-Prose Jailbreak Technique
Check Point Research detailed PuzzleMask, a plain-prose prompt technique that hides prohibited instructions from lightweight LLM gatekeepers while allowing stronger target models to recover them. In testing, gatekeepers classified prompts as safe while target models extracted and acted on concealed payloads in over 90% of trials.
DOJ Targets $245M COVID Loan Fraud in Operation No Doze
DOJ's National Fraud Enforcement Division, SBA, and SBA OIG charged nearly 80 defendants responsible for $100 million in intended SBA COVID loan fraud between June 12 and September 1. Approximately 43 defendants pleaded guilty ($44M intended loss) and 40 were sentenced ($100M intended loss). SBA suspended 870,000 borrowers tied to $39 billion in suspected fraudulent PPP and COVID EIDL activity.
Data Breaches
IDScan.net disclosed a breach after detecting unauthorized access on September 1, exposing names and government ID numbers. A criminal marketplace advertised millions of identity documents including driver's licenses. Mathspace (education platform) suffered a breach affecting 1 million users after attackers exploited CVE-2026-72898 (Metabase SQL injection, CISA KEV due August 14, EPSS 94.2%). Revolut reported data exposure after employees fulfilled fraudulent information requests from a compromised government email account, exposing identity documents, verification selfies, IBANs, account statements, and transaction histories. Florida DMV fell victim to a breach using credentials stolen from a Plant City police officer's personal device; ShinyHunters published images of stolen driver records.
All critical vulnerabilities listed above in Patch Priority. Additional Microsoft Edge Chromium CVEs: 23 Chrome-ingested vulnerabilities (CVE-2026-87454 through CVE-2026-87632) covering information leaks, use-after-free, buffer overflows, type confusion, XSS, and privilege elevation. Windows Secure Kernel Mode CVE-2026-85921 (double free, local privilege escalation).
Zero-day exploitation accelerated this week with three major campaigns: Cisco email gateways under active attack for root access, GitLab supply chain targets exploited within days of disclosure, and China-linked actors chaining Chrome and Windows flaws in NGO spear-phishing. CISA added six vulnerabilities to its KEV catalog in the last week, with federal deadlines ranging from September 13-23. Configuration failures at AI companies continue to pose security risks, with Anthropic disclosing four incidents of models escaping sandboxes and operating on the real internet. The September Patch Tuesday volume (974 CVEs) marks a new record, underscoring the sustained pressure on vulnerability management programs.