cybr.cx Daily Digest — September 23, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-93616 | Check Point Security Management (path traversal, unauthenticated RCE)
An unauthenticated path traversal in Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, and SmartEvent allows attackers to upload and execute arbitrary scripts remotely. CISA has set a patch deadline of September 25 — if you're running any of these on-prem, treat this as a fire drill. Exploitation is confirmed in the wild.

⚠️ Actively exploited — CVE-2026-85102 | Check Point Security Gateway / Spark Firewall (improper certificate validation, RCE)
A second Check Point flaw being actively exploited: improper certificate validation in Site-to-Site and Remote Access VPN configurations allows unauthenticated remote code execution directly on the gateway. Combined with CVE-2026-93616 above, Check Point environments are facing a serious double-threat this week. Patch or isolate management interfaces immediately.

⚠️ Actively exploited — CVE-2026-94127 | F5 BIG-IP APM (heap buffer overflow, unauthenticated RCE)
A heap-based buffer overflow in F5 BIG-IP APM is triggered when both an access policy and an OAuth profile are configured on a virtual server. An unauthenticated attacker can achieve remote code execution — a particularly dangerous combination given how widely BIG-IP APM fronts enterprise authentication infrastructure. CISA due date: September 25.

⚠️ Actively exploited — CVE-2026-93952 | Arista VeloCloud Orchestrator (improper input validation, privilege escalation)
Active exploitation of Arista's VeloCloud Orchestrator on-prem allows remote attackers to access privileged internal functionality and compromise the orchestrator host, threatening confidentiality, integrity, and availability of SD-WAN management infrastructure. Organisations using VCO on-prem should assume exposure and apply vendor guidance immediately.

⚠️ Actively exploited — CVE-2026-76460 | Cisco Identity Services Engine (authentication bypass)
An incorrect use of privileged APIs in Cisco ISE and ISE-PIC allows unauthenticated remote attackers to bypass the web management interface and gain unauthorised access. Given ISE's role as a network access control chokepoint, successful exploitation can hand an attacker the keys to your entire NAC policy engine.

⚠️ Actively exploited — CVE-2026-7273 | Zyxel GS1900 Series Switches (stack buffer overflow, OS command injection)
A stack-based buffer overflow in the CGI program of Zyxel GS1900 switches can be exploited by an unauthenticated attacker on the local network via a crafted HTTP request to execute OS commands. LAN-based exploitation lowers the bar considerably in environments with flat network segments.

⚠️ Actively exploited — CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 | Linux Kernel (race condition, OOB write, TLS handling flaw)
Three Linux kernel vulnerabilities are seeing active exploitation. CVE-2025-39964 is a race condition in AF_ALG socket handling; CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT target affecting splice-imported file pages; CVE-2025-39682 is a TLS receive-path flaw allowing zero-length records to bypass record-type handling. All three have passed their CISA remediation deadlines — patch or apply mitigations now.

CVE-2026-28325 | SolarWinds Observability Self-Hosted (unauthenticated RCE via deserialization, CVSS 8.8)
Deserialization of untrusted data in a specific SolarWinds Observability communication mode exposes the platform to unauthenticated remote code execution. SolarWinds products remain high-value targets; this needs immediate attention from any team running the self-hosted variant.

CVE-2026-34689 | Adobe Connect (path traversal, unauthenticated arbitrary file read, CVSS 8.6)
An unauthenticated path traversal in Adobe Connect allows attackers to read arbitrary files outside the intended directory scope, with scope change noted — meaning impact can extend beyond the application itself. No user interaction required.

CVE-2026-82003 | Adobe Campaign Classic (improper input validation, code execution, CVSS 8.5)
A low-privileged attacker can exploit improper input validation in Adobe Campaign Classic to execute arbitrary code without user interaction. The scope change flag means blast radius may extend to adjacent systems — relevant for organisations running ACC as part of a broader marketing or data pipeline.

Headline News

Claimed FBI Employee Data Breach Puts Federal Personnel Security Under Scrutiny

A hacking group has publicly claimed to have breached the FBI and obtained data on all Bureau employees, posting details to back their assertion. If the claim holds up, the implications extend well beyond embarrassment: employee rosters, contact details, and potentially role information for federal law enforcement personnel create significant counterintelligence and physical security risks. This type of data is prime material for spear-phishing campaigns, social engineering operations, or foreign intelligence targeting of individual agents. The breach — if confirmed — would represent one of the most sensitive federal personnel compromises in recent memory, echoing the 2015 OPM incident but targeting active law enforcement specifically. Practitioners supporting federal or cleared contractor environments should treat this as a threat-actor enrichment event and expect increased targeting of government-adjacent personnel in the near term.

CISA Confirms Active Exploitation of Three Linux Kernel Vulnerabilities

CISA has formally warned that three Linux kernel flaws — a race condition in AF_ALG socket handling, an out-of-bounds write in ebtables' SNAT target, and a TLS receive-path bypass — are being actively exploited in the wild. The vulnerabilities span different kernel subsystems, suggesting either broad opportunistic scanning or a sophisticated actor with deep kernel knowledge working across multiple attack surfaces. The ebtables flaw is particularly notable: it allows an OOB write into a file page backed by a splice-imported socket buffer, a low-level primitive that can be leveraged for privilege escalation. All three have passed their CISA remediation deadlines, meaning federal agencies are already out of compliance. For enterprise Linux defenders, prioritise patching across container hosts, cloud instances, and any internet-exposed Linux infrastructure — kernel exploits in the wild rarely stay targeted for long.

Meta Muse AI App Flaw Exposes Voice Dictation Traffic to Local Redirect

A vulnerability in Meta's Muse AI application allows locally running malware to intercept and redirect dictation traffic, potentially exposing voice prompts and spoken input to attacker-controlled endpoints. The flaw represents a class of attack that's growing in relevance as AI-powered dictation and voice interfaces become embedded in productivity workflows — the threat model here isn't remote exploitation but rather privilege abuse by malware already present on the host. For security teams managing BYOD or unmanaged endpoints, this is a reminder that AI application integrations are expanding the local attack surface in ways traditional DLP tooling doesn't yet cover well. Organisations handling sensitive verbal communications — legal, executive, healthcare — should evaluate whether AI dictation tools are permitted on endpoints that also handle confidential data.

Schrödinger's Feed

Stanford researchers have achieved something genuinely strange: real-time observation of single phonons — quantum packets of sound — making abrupt quantum jumps between discrete energy states. This is the acoustic equivalent of watching an electron snap between orbitals, and it's the first time it's been done with sound. The breakthrough has immediate implications for quantum error correction, where understanding and detecting state transitions is fundamental to building reliable qubits. For cryptography practitioners, it's a reminder that quantum hardware capabilities are advancing along multiple physical substrates simultaneously — the timeline for cryptographically relevant quantum computers keeps getting harder to call, which is exactly why migrating to NIST-standardised PQC algorithms now, rather than waiting for a clearer threat horizon, remains the sound advice.

/dev/random

OpenAI's GPT-6 Astra has done something historians and cryptanalysts have failed to do for twenty-one years: cracked the MVUEH Enigma message, a World War II intercept that has resisted solution since it surfaced in 2005. The message was part of a small set of Kriegsmarine Naval Enigma traffic that survived without recoverable keys or cribs — the classic handholds that human codebreakers and earlier computational methods depend on. Astra apparently approached it as a constrained optimisation problem over the Enigma keyspace, without needing a known plaintext entry point. Whether this signals a genuine shift in AI capability for classical cipher cryptanalysis — or just a very expensive brute-force with good heuristics — is exactly the kind of argument that will keep mailing lists busy for weeks.