Weekly digest: week ending 19 September 2026

This week was about control planes and kernels: CISA stamped a maximum-severity Cisco Identity Services Engine authentication bypass as actively exploited, added three Linux kernel local-privilege flaws to the Known Exploited Vulnerabilities catalog, and Check Point shipped a fix for unauthenticated root code execution in its Security Management and Log Servers. Almost every KEV entry this week carried a three-day federal remediation deadline.

The big three

Cisco ISE authentication bypass, CVSS 10.0, exploited

CISA added CVE-2026-76460 to KEV on 16 September, with a federal remediation deadline of 19 September. Cisco has said the flaw is being exploited in attacks and rates it 10.0 — an unauthenticated attacker sends a crafted request to an API endpoint with insufficient authentication control and gains unauthorised access to the device, bypassing the web management interface.

Both Cisco Identity Services Engine and the Passive Identity Connector (ISE-PIC) are named in the catalogue entry. None of the sources we reviewed list affected or fixed release trains, so the version mapping has to come from Cisco’s own advisory. The sources also do not say when exploitation began, who is behind it, or what privilege level an attacker ends up with; the published CVSS vector does include a scope change, which indicates impact beyond the vulnerable component.

If you run ISE, it is the thing deciding who gets onto your network. Treat every node as in scope until proven otherwise.

Three Linux kernel flaws added to KEV, three-day deadline

On 18 September CISA listed CVE-2025-39682, a bug in the kernel TLS receive path carrying a CVSS score of 9.8, as actively exploited, with remediation due 21 September. Separately it added CVE-2025-39964 and CVE-2026-53266 — a race condition in the AF_ALG crypto socket interface and an out-of-bounds write in the netfilter bridge ebt_snat target — on the same date and with the same deadline.

One reporting discrepancy is worth carrying forward: CISA’s own alert described a single addition, while The Hacker News reported three Linux kernel flaws added together. We are treating the three named CVEs as the confirmed set and not speculating beyond them.

The load-bearing gap in all three is version mapping. The CVE records are written in upstream “resolved” form, so fixes exist in mainline, but no source we have states which distribution package versions carry them. Exposure also varies by configuration: AF_ALG matters only if userspace can open those sockets, the netfilter bug needs the bridge path and ebtables SNAT rules in use, and kernel TLS tends to appear where TLS processing has been pushed into the kernel for throughput. CISA names no actor, target set or technique for any of them.

Check Point patches pre-auth root RCE in Security Management and Log Servers

CVE-2026-91843 is a stack-based buffer overflow in the login path — before authentication succeeds — of Check Point Security Management Server and Log Server, with a CVSS score of 9.8. A fix is out via LivePatch, and Check Point offers a Trusted Clients restriction as mitigation.

No source states that this one has been exploited. Our enrichment feed flags the Check Point cluster as exploited, but that reflects two older, separate KEV entries rather than this CVE. Affected and fixed build numbers are not published in the sources we have, so verify against Check Point’s advisory.

The reason it belongs in the top three is placement: the management server holds firewall policy and pushes it to gateways, and the log server holds the record of what those gateways saw. Root on either is a compromise of the decision-making layer, not just an endpoint.

Also this week

• ConnectWise ScreenConnect: CVE-2026-84869 is in KEV; fixed in 26.6.5, client-side only, servers not impacted, with over 1,000 unpatched instances still reachable.
• Acronis Backup plugin for cPanel & WHM exploited in targeted attacks; Plesk and DirectAdmin builds also fixed.
• Google patched a Pixel cellular modem permission bypass that needs no user interaction and may be under limited, targeted exploitation.
• Siemens Mendix SAML signature verification flaw; update to module 4.2.3 or 3.6.27 depending on platform.
• A New Jersey court ordered Radaris domains transferred to Atlas Data Privacy Corp after the defendants failed to appear.
• Gyazo server flaw exploited to steal 23.6 million user records — BleepingComputer.
• Brevo supply-chain attack injected ClickFix scripts into customer sites — BleepingComputer.
• Critical heap overflow in the Unbound DNSSEC validator, reachable via a malicious DNS zone — The Hacker News.
• Unauthenticated deserialisation RCE in Cisco Secure Firewall Management Center — ZDI-26-709.
• North Korean “WaterPlum” campaign infected thousands of devices across 100 countries — The Record.
• Iranian operators using CHOSEN BRICK Windows malware for espionage — BleepingComputer.
• CISA advisories: Wärtsilä FOS-Onboard and Mitsubishi Electric CC-Link IE TSN.
• New CISA guidance on protecting tokens and assertions from forgery, theft and misuse.
• Researchers used Claude to hack OpenAI — Ars Technica.

One thing to do this weekend

Inventory your security management plane and confirm each box is both patched and unreachable from anywhere it does not need to be.

• List every Cisco ISE and ISE-PIC node, Check Point Security Management and Log Server, and ScreenConnect deployment you own.
• For each, record the running build and compare it against the vendor advisory — not against a mailing-list summary.
• Check what can reach the management interface. Apply Check Point’s Trusted Clients restriction where the fix has not landed yet, and disable ScreenConnect TransferFiles permissions if you are not yet on 26.6.5.
• On the Check Point side, search Audit and Admin login logs for Administrator failed to log in: Username too long.
• Queue the Linux kernel updates for Monday, but first ask your distribution which package version carries the fixes for CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 — that mapping is not in the public CVE records.